SQLi at █████ parameter

Summary

A critical SQL injection vulnerability was discovered in an items endpoint that accepted unauthenticated POST requests without CSRF validation. The vulnerability allowed attackers to execute arbitrary SQL commands, extract database metadata including PostgreSQL version and user accounts, and perform time-based blind injection attacks. Additional security issues included stored XSS through the description parameter and complete lack of authentication controls. The endpoint was successfully exploited to reveal database schema information and demonstrate data injection capabilities. The vulnerability was promptly remediated by the security team, and we appreciate the thorough research and responsible disclosure provided by the security researcher.