This vulnerability involves SQL injection in the QuantumNous new-api product, specifically in the SearchUserTopUps/SearchAllTopUps functions of the model/topup.go file. The issue allows remote attackers to inject malicious SQL commands due to insufficient input sanitization or validation. The vulnerability affects versions 0.12.0 and 0.12.1. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No official remediation or patch has been provided by the vendor, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited scope of confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing temporary mitigations such as input validation, web application firewalls (WAF) with SQL injection detection, or restricting access to the vulnerable API endpoints until an official patch is released.