The vulnerability resides in the arr2sql function of the func.php file in the nemoTyrant Manong application, allowing attackers to inject arbitrary SQL statements. This flaw is caused by insufficient validation of input parameters (CWE‑74) and the direct incorporation of that input into SQL queries (CWE‑89). If exploited, an attacker could read, modify, or delete database records, compromising confidentiality, integrity, and potentially availability.

The issue affects all releases of the nemoTyrant Manong application prior to the commit 7c9e5228e133b9267ad3a415833bc9bb53193bb4. Because the product follows a rolling release model, specific version numbers are not published; users should consider any deployment that includes the vulnerable code prior to that commit as exposed.

The CVSS score of 6.9 indicates a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely via a web request that targets the cache/del_cache/arr2sql endpoint. Since the vulnerability involves direct SQL construction, exploitation requires no special privileges beyond remote access, making it potentially attractive to attackers who can reach the application over the network.