The vulnerability stems from unsanitized use of the 'where' parameter in SQL query construction. In GetRowsInfo, the code uses fmt.Sprintf to directly insert user-controlled 'where' input into the SQL string (line 189 in original code). This allows attackers to inject arbitrary SQL commands. The getOpenRowsInfoHandler exposes this vulnerability via an API endpoint, as shown in the POC where pg_sleep() was injected. The commit fixed this by removing the entire database.go file containing these functions, indicating they were the attack surface.