Authenticated data disclosure via ORDER BY injection

SQL injection in Amir Sanni Mini Inventory and Sales Management System 0.1 lets remote authenticated users read data via crafted sort parameters. In the SQLite3 code path, Transaction::getAll in application/models/Transaction.php builds a raw query string and interpolates GET-derived orderBy and orderFormat values into ORDER BY without SQL escaping, while the MySQL branch uses the query builder. Exposure requires a valid application session and SQLite3 deployment; the published proof of concept shows boolean-based blind extraction of administrator password data through the /transactions/latr_ endpoint.