This vulnerability involves SQL injection in the SearchUserTopUps/SearchAllTopUps function of QuantumNous new-api (up to version 0.12.1). The issue arises from improper handling of user input in the SQL queries within the model/topup.go file, enabling remote attackers to inject malicious SQL commands. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. Although the exploit is publicly available, there is no known exploit in the wild and no vendor response or patch has been provided to date.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data disclosure, modification, or other database impacts. The vulnerability does not require user interaction and has low attack complexity. However, the overall impact is rated medium due to limited privileges required and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider implementing temporary mitigations such as input validation, parameterized queries, or restricting access to the vulnerable API endpoints until an official fix is released.