SQL injection occurs at the '/stockreports/spendings' endpoint through the `product-group` parameter. This allows attackers to access sensitive database information by using a crafted SQL statement. SQL injection is a type of flaw where an attacker can interfere with the queries that an application makes to its database.