EUVD-2026-40295
GHSA-gvp3-3684-gppw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable injection with no auth where an app exposes identifier inputs; full database read/write/DoS impact justifies C:H/I:H/A:H, consistent with the published 9.8.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers.
The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers (order_by, where-clause column keys, field and returning lists, upsert columns, and join aliases) reach the SQL string raw, while values are placeholder-bound and unaffected.
A caller that forwards untrusted input to an affected identifier position, such as a user-controlled order_by value, enables SQL injection: the row order can be made to depend on a sub-select over columns the query never selected, and the where and update identifier positions permit further data disclosure and tampering.
AnalysisAI
SQL injection in DBIx::QuickORM (a Perl ORM) before version 0.000026 lets attackers manipulate queries through unquoted SQL identifiers. Because the bundled SQL::Abstract subclass sets bindtype but never quote_char, caller-supplied identifiers such as order_by values, where-clause column keys, field/returning lists, upsert columns, and join aliases are emitted verbatim into the SQL string while only values are placeholder-bound. An application that forwards untrusted input into any of these identifier positions exposes data disclosure and tampering; no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Technical ContextAI
DBIx::QuickORM is an object-relational mapper for Perl whose default SQL builder is implemented as a subclass of SQL::Abstract. SQL::Abstract separates bound values (safe placeholders) from identifiers (table/column names) and only quotes identifiers when its quote_char attribute is set. The subclass configures bindtype in its constructor but omits quote_char, so SQL::Abstract leaves all identifiers unquoted and unescaped. This is a classic CWE-89 (SQL Injection) whose root cause is specific to the identifier channel rather than the value channel: parameterized values stay safe, but column names, sort keys, returning lists, upsert targets, and join aliases pass into the raw query text. The affected package is identified by CPE cpe:2.3:a:exodist:dbix::quickorm:*:*:*:*:*:*:*:* (author EXODIST on CPAN).
RemediationAI
Upgrade DBIx::QuickORM to version 0.000026 or later, which is the vendor-released patch (commit 43d7684682050780f056f25e1879191fb0a3265e, see https://github.com/exodist/DBIx-QuickORM/commit/43d7684682050780f056f25e1879191fb0a3265e.patch and https://metacpan.org/release/EXODIST/DBIx-QuickORM-0.000026/changes). If immediate upgrade is not possible, the practical compensating control is to stop passing untrusted input into identifier positions: validate or allowlist any user-supplied order_by values, where-clause column keys, field/returning lists, upsert columns, and join aliases against a fixed set of known column names before they reach the ORM, since these are the unquoted channels - bound values remain safe. The trade-off of strict allowlisting is reduced flexibility in dynamic sorting/filtering features, but it directly closes the injection channel until the patched release is deployed.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today