The vulnerability in Perl's SQL::Abstract module allows an attacker to inject arbitrary SQL by supplying untrusted input as a where value inside a nested statement positioned as an identifier. The injection occurs when the module treats these values as part of the SQL text rather than a bind parameter, leading to potential data exposure, modification, or deletion. This flaw is identified as CWE‑89, reflecting an improper handling of user input in SQL construction.

The CVE affects Perl applications that include SQL::Abstract versions 1.90_01 through any release prior to 2.000001_04. The module is distributed via CPAN and widely used in database abstraction layers; any code that relies on these versions for query generation is vulnerable. No specific vendor or additional product names are disclosed beyond the Perl module itself.

The CVSS score is not provided and the EPSS score is unavailable, but the nature of an SQL injection grants the attacker extensive capabilities. The vulnerability is not listed in CISA’s KEV catalog, yet its exploitation potential remains high, especially in applications that accept user input without proper validation or binding. An attacker could exploit this flaw if the application exposes the vulnerable query paths through a web interface or other remote service, or via local code injection if such nested statements are used with untrusted input.