Chad Granum

**Name of the Vulnerable Software and Affected Versions** DBIx::QuickORM versions prior to 0.000026 **Description** An issue exists where SQL identifiers are emitted verbatim into generated queries without proper quoting or escaping. This occurs because the default SQL builder, a SQL::Abstract subclass, fails to set the `quote char` in its constructor. Consequently, caller-supplied identifiers reach the SQL string raw, while only values are placeholder-bound. An attacker can exploit this by providing crafted input to identifier positions, such as `order by` values, where-clause column keys, field and returning lists, upsert columns, and join aliases. This can lead to unauthorized data disclosure and tampering, such as making row order depend on a sub-select over columns not originally selected. **Recommendations** Update to version 0.000026.