Order By Blind SQL Injection

A NahamCon CTF 2022 Flask challenge passes unsanitized user input straight into SQLAlchemy's order_by(text(...)) call, letting a CASE-based blind SQL injection exfiltrate the flag character by character.