diff --git a/routes/chaosRoute1.ts b/routes/chaosRoute1.ts
new file mode 100644
index 00000000000..8de16f5965b
--- /dev/null
+++ b/routes/chaosRoute1.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute1 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q1 = req.query.q1 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute2.ts b/routes/chaosRoute2.ts
new file mode 100644
index 00000000000..57b491e2eed
--- /dev/null
+++ b/routes/chaosRoute2.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute2 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q2 = req.query.q2 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q2}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute3.ts b/routes/chaosRoute3.ts
new file mode 100644
index 00000000000..45686b3163c
--- /dev/null
+++ b/routes/chaosRoute3.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute3 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q3 = req.query.q3 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q3}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute4.ts b/routes/chaosRoute4.ts
new file mode 100644
index 00000000000..2ecb8549736
--- /dev/null
+++ b/routes/chaosRoute4.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute4 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q4 = req.query.q4 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q4}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute5.ts b/routes/chaosRoute5.ts
new file mode 100644
index 00000000000..f26a61ec6c5
--- /dev/null
+++ b/routes/chaosRoute5.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute5 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q5 = req.query.q5 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q5}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute6.ts b/routes/chaosRoute6.ts
new file mode 100644
index 00000000000..d5ef2dc182d
--- /dev/null
+++ b/routes/chaosRoute6.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute6 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q6 = req.query.q6 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q6}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute7.ts b/routes/chaosRoute7.ts
new file mode 100644
index 00000000000..743decfa9e3
--- /dev/null
+++ b/routes/chaosRoute7.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute7 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q7 = req.query.q7 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q7}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute8.ts b/routes/chaosRoute8.ts
new file mode 100644
index 00000000000..05c73b8b47e
--- /dev/null
+++ b/routes/chaosRoute8.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute8 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q8 = req.query.q8 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q8}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/routes/chaosRoute9.ts b/routes/chaosRoute9.ts
new file mode 100644
index 00000000000..526005ff6da
--- /dev/null
+++ b/routes/chaosRoute9.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+module.exports = function chaosRoute9 () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const q9 = req.query.q9 ?? ''
+    models.sequelize.query(`SELECT * FROM Products WHERE name = '${q9}'`)
+      .then(([rows]: any) => { res.json({ rows }) })
+      .catch((error: Error) => { next(error) })
+  }
+}
diff --git a/server.ts b/server.ts
index c2689cc8d39..6b2d81ab141 100644
--- a/server.ts
+++ b/server.ts
@@ -102,6 +102,15 @@ const web3Wallet = require('./routes/web3Wallet')
 const updateProductReviews = require('./routes/updateProductReviews')
 const likeProductReviews = require('./routes/likeProductReviews')
 const security = require('./lib/insecurity')
+const chaosRoute1 = require('./routes/chaosRoute1')
+const chaosRoute2 = require('./routes/chaosRoute2')
+const chaosRoute3 = require('./routes/chaosRoute3')
+const chaosRoute4 = require('./routes/chaosRoute4')
+const chaosRoute5 = require('./routes/chaosRoute5')
+const chaosRoute6 = require('./routes/chaosRoute6')
+const chaosRoute7 = require('./routes/chaosRoute7')
+const chaosRoute8 = require('./routes/chaosRoute8')
+const chaosRoute9 = require('./routes/chaosRoute9')
 const app = express()
 const server = require('http').Server(app)
 const appConfiguration = require('./routes/appConfiguration')
@@ -571,6 +580,15 @@ restoreOverwrittenFilesWithOriginals().then(() => {
   app.get('/rest/basket/:id', basket())
   app.post('/rest/basket/:id/checkout', order())
   app.put('/rest/basket/:id/coupon/:coupon', coupon())
+  app.get('/rest/chaos/1', chaosRoute1())
+  app.get('/rest/chaos/2', chaosRoute2())
+  app.get('/rest/chaos/3', chaosRoute3())
+  app.get('/rest/chaos/4', chaosRoute4())
+  app.get('/rest/chaos/5', chaosRoute5())
+  app.get('/rest/chaos/6', chaosRoute6())
+  app.get('/rest/chaos/7', chaosRoute7())
+  app.get('/rest/chaos/8', chaosRoute8())
+  app.get('/rest/chaos/9', chaosRoute9())
   app.get('/rest/admin/application-version', appVersion())
   app.get('/rest/admin/application-configuration', appConfiguration())
   app.get('/rest/repeat-notification', repeatNotification())