diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm
index be67162a9c..52a9c41997 100644
--- a/C4/Acquisition.pm
+++ b/C4/Acquisition.pm
@@ -2530,7 +2530,7 @@ sub GetInvoices {
     if ( $args{order_by} ) {
         my ( $column, $direction ) = split / /, $args{order_by};
         if ( grep { $_ eq $column } @columns ) {
-            $direction ||= 'ASC';
+            $direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC';
             $query .= " ORDER BY $column $direction";
         }
     }
diff --git a/t/db_dependent/Acquisition/Invoices.t b/t/db_dependent/Acquisition/Invoices.t
index 0ac98f044f..0c130d94ea 100755
--- a/t/db_dependent/Acquisition/Invoices.t
+++ b/t/db_dependent/Acquisition/Invoices.t
@@ -9,7 +9,7 @@ use Koha::Acquisition::Orders;
 use Koha::Database;
 
 use Test::NoWarnings;
-use Test::More tests => 30;
+use Test::More tests => 31;
 
 BEGIN {
     use_ok(
@@ -223,6 +223,14 @@ is_deeply(
     "GetInvoices return linked_to_subscriptions: there is no invoices linked to subscriptions yet"
 );
 
+subtest 'prevent SQL injection in GetInvoices for order_by' => sub {
+    plan tests => 1;
+
+    # No error
+    GetInvoices( order_by => 'shipmentdate ASC,(SELECT/**/1/**/FROM/**/koha_zzz_nope)' );
+    pass();
+};
+
 END {
     $dbh and $schema->storage->txn_rollback();
 }