When ORDER BY Becomes Code: Finding a SQL Injection in Frappe's Query Layer

Modern applications often expose flexible querying features to users, allowing sorting, filtering, grouping, and searching through APIs. While these features improve usability, they can also blur the line between user data and executable SQL.

In this talk, I will walk through how a white-box security review of the Frappe Framework uncovered a SQL injection vulnerability in the query-building layer behind a whitelisted API endpoint. The vulnerable code attempted to protect dynamically generated SQL using a denylist-based validator, blocking a collection of dangerous functions while permitting user-controlled expressions in ORDER BY and GROUP BY clauses.

By examining the validator's assumptions and comparing them against the actual SQL grammar accepted by the database, I found that conditional expressions remained available despite the protection logic. This created a path for authenticated users to influence query execution in ways the framework did not intend, demonstrating how security controls that focus on known dangerous patterns can leave entire classes of behavior exposed.

The session will cover the process of tracing user-controlled input through a large open-source codebase, identifying trust boundaries in query construction, and evaluating whether a security control actually enforces the property it claims to provide. I will also discuss why ORDER BY injection is frequently underestimated, how attackers can transform it into a practical data-extraction primitive, and what robust alternatives exist for safely implementing user-controlled sorting.

Although the case study focuses on Frappe, the lessons apply broadly to web frameworks, ORMs, API design, and any system that generates SQL from user input.

• Why ORDER BY and GROUP BY clauses are common but overlooked SQL injection surfaces.

• The strengths and weaknesses of denylist-based security validation.

• A practical methodology for reviewing query builders and dynamic SQL generation logic.

• How attackers can leverage non-traditional SQL injection primitives without direct query concatenation into WHERE clauses.

• Design patterns for implementing secure user-controlled sorting and grouping features.