Executive brief
DBIx::QuickORM is a Perl library used by developers to interact with databases. A vulnerability in versions prior to 0.000026 allows attackers to perform SQL injection attacks by providing malicious input to certain query parameters like sorting or filtering fields. This could allow an unauthorized user to view sensitive data they shouldn't see or modify database records, potentially leading to a full compromise of the application's data.
Technical details
A SQL injection vulnerability exists in DBIx::QuickORM due to the default SQL builder (a SQL::Abstract subclass) failing to set a 'quote_char'. This causes SQL identifiers—including order_by clauses, where-clause column keys, field lists, and join aliases—to be emitted verbatim into SQL strings rather than being properly quoted. An attacker can exploit this by providing crafted input to any application interface that forwards untrusted data to these identifier positions. This allows for data exfiltration via sub-selects or data tampering in update/where positions. The issue is resolved in version 0.000026 by enforcing identifier quoting based on the database driver's specific quote character.
Affected products
- EXODIST (Chad Granum) DBIx::QuickORM < 0.000026
Timeline
- 2026-06-29: patched: Fix committed to repository.
- 2026-06-30: disclosed: Vulnerability published.