The ORM Didn't Save You: SQL Injection in a Prisma Codebase

This writeup walks through a SQL injection in the product search feature of the oss-oopssec-store , an intentionally vulnerable e-commerce app for learning web security. The lab is built with Next.js and Prisma , so you might assume the ORM shields you from SQLi by default, and it mostly does, until someone reaches for $queryRawUnsafe and drops user input straight into a raw query. That's exactly what happens here. The search input gets interpolated into the SQL string with no sanitization, so y