#psycopg

SQL injection through the ORDER BY sort parameter in a FastAPI listing endpoint

Every value in our orders API was a bound parameter, except the sort column, which was pasted into ORDER BY from the query string. A pentest proved it was injectable. We replaced it with an allowlist map and added tests that fuzz the sort input.