A SQL injection vulnerability was found in sources-api-go. The applyFilters() function builds GORM Where() clauses by string-formatting the caller-supplied column name into SQL. middleware/filtering.go passes any query-parameter key that is not limit, offset, or sort_by into filter.Name with no sanitisation, allowing arbitrary SQL expressions to be injected into the WHERE clause. The sort_by parameter is also passed to query.Order() via string concatenation.

Any authenticated console.redhat.com user can inject SQL through query parameter filtering, leading to information disclosure of internal database fields and schema details, arbitrary PostgreSQL function execution through the WHERE clause, SQL error details returned in HTTP responses, and denial of service from expensive SQL expressions.

Affected code:
- middleware/filtering.go:63-77 — raw query-param key becomes filter.Name with no sanitisation
- dao/filtering.go:65,80-83 — column name string-concatenated into WHERE clause
- dao/filtering.go:114-117 — sort_by value passed to query.Order() via string concatenation

Confirmed on staging.

Upstream issue: https://redhat.atlassian.net/browse/RHCLOUD-49586