SQL injection in order search
src/api/orders.ts:41–44 · High confidence
What we found
The route builds a SQL statement by inserting req.query.ref into the query string. A crafted reference can change what the query does.
Observed code · src/api/orders.ts
41const ref = req.query.ref;42const orders = await db.query(`43 SELECT * FROM orders WHERE ref = '${ref}'44`);
Why it matters
If the route is reachable and the database account can see sensitive records, an attacker may read data outside the intended lookup. Real impact depends on authentication, database permissions and deployment, so verify it in context.
Suggested fix
Use your driver’s parameter binding. This example uses PostgreSQL-style placeholders. Keep the route’s existing authentication and authorisation checks.
Suggested implementation · src/api/orders.ts
41const ref = req.query.ref;42const orders = await db.query(43 'SELECT * FROM orders WHERE ref = $1', [ref]44);
Severity reflects likely impact, not proven exploitability. Validate each finding in context.