diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm
index 253c509b49..df4bdc938b 100644
--- a/C4/Acquisition.pm
+++ b/C4/Acquisition.pm
@@ -2483,7 +2483,7 @@ sub GetInvoices {
     if($args{order_by}) {
         my ($column, $direction) = split / /, $args{order_by};
         if(grep  { $_ eq $column } @columns) {
-            $direction ||= 'ASC';
+            $direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC';
             $query .= " ORDER BY $column $direction";
         }
     }
diff --git a/t/db_dependent/Acquisition/Invoices.t b/t/db_dependent/Acquisition/Invoices.t
index 337bd94883..5386f17ce5 100755
--- a/t/db_dependent/Acquisition/Invoices.t
+++ b/t/db_dependent/Acquisition/Invoices.t
@@ -8,7 +8,7 @@ use Koha::Acquisition::Booksellers;
 use Koha::Acquisition::Orders;
 use Koha::Database;
 
-use Test::More tests => 29;
+use Test::More tests => 30;
 
 BEGIN {
     use_ok('C4::Acquisition', qw( NewBasket GetBasket AddInvoice GetInvoice ModReceiveOrder GetInvoiceDetails GetInvoices ModInvoice CloseInvoice ReopenInvoice MergeInvoices DelInvoice ));
@@ -214,6 +214,14 @@ my @invoices_linked_to_subscriptions = map{
 } @invoices;
 is_deeply( \@invoices_linked_to_subscriptions, [], "GetInvoices return linked_to_subscriptions: there is no invoices linked to subscriptions yet" );
 
+subtest 'prevent SQL injection in GetInvoices for order_by' => sub {
+    plan tests => 1;
+
+    # No error
+    GetInvoices( order_by => 'shipmentdate ASC,(SELECT/**/1/**/FROM/**/koha_zzz_nope)' );
+    pass();
+};
+
 END {
     $dbh and $schema->storage->txn_rollback();
 }