DBIx::QuickORM versions prior to 0.000026 use a SQL::Abstract subclass as the default SQL builder that sets bindtype but does not set quote_char. As a result, SQL identifiers provided by the caller (including order_by, where-clause column keys, field lists, returning lists, upsert columns, and join aliases) are inserted verbatim into SQL statements without quoting. While values are safely placeholder-bound, untrusted input in identifier positions can lead to SQL injection. This vulnerability allows attackers to manipulate query order, disclose data, and tamper with queries by injecting malicious SQL through unquoted identifiers.

An attacker who can supply input to identifier positions in SQL queries (such as order_by or where-clause columns) can perform SQL injection attacks. This can result in unauthorized data disclosure, modification, or tampering with database queries. The vulnerability affects the integrity and confidentiality of the database operations performed by DBIx::QuickORM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input to SQL identifier positions such as order_by, where-clause columns, field lists, returning lists, upsert columns, and join aliases. Implement input validation or sanitization to ensure identifiers are safe or use alternative query-building methods that properly quote identifiers.