A SQL injection vulnerability exists in the SQL storage module of Apache SIS versions 1.0 through 1.6 inclusive. The issue arises when sorting a stream of features, as the sort clause is copied after ORDER BY without properly quoting identifier characters, allowing crafted input to inject SQL code. This vulnerability is fixed in version 1.7.