A flaw was found in the Katello plugin for Red Hat Satellite. The vulnerability occurs due to improper sanitization of user-provided input in the sort_by parameter of the /api/hosts/bootc_images API endpoint. An attacker could exploit this flaw by injecting arbitrary SQL commands into the order clause of the database query. While certain complex queries are blocked by the underlying framework's protections, an attacker can still manipulate the query structure to trigger database errors, cause a Denial of Service (DoS), or potentially perform Boolean-based Blind SQL injection.