Consider code similar to this:

String orderBy = getParameter("orderBy");
String orderDir = getOrderDir(); // returns "asc" or "desc"
String query = "from User order by " + orderBy + " " + orderDir;

The query is used as a JPA query (NOT as a native query).
Considering the restrictions of JPQL what value could be used for parameter orderBy to cause any actual harm and not just exception caused by faulty query?

JPQL does not allow union or comments (–) so I do not know how / if one could cause any harm in the system.
I do understand that this needs to be fixed, but I am wondering how dangerous this vulnerability actually is.