Xcatolin

A mass assignment issue exists in the patient portal OnsiteDocument query API. This flaw allows authenticated users to set bitwise criteria filters through request parameters, which are then inserted unquoted into the SQL WHERE clause. An attacker can perform SQL injection using parameters such as `Id BitwiseAnd` to access any database table, potentially exposing other patients' records and staff password hashes.

An issue allows unauthenticated attackers to induce the server to send HTTP requests by registering an OAuth2 client with an unvalidated `jwks uri`. This can be triggered via the token introspection endpoint using an unsigned `client assertion`, enabling the probing of internal services and access to cloud metadata endpoints. Server-side request forgery is a flaw where a server is tricked into making requests to an unintended location.