New Attack Vector for RAG Systems: CareAttack Manipulates Retriever Parameters to Tamper with Ranking Logic