The flaw originates from unsafe literal substitution when assembling an IN (…) clause in Damblan_Karma queries. An attacker can inject arbitrary SQL through input that is incorporated into this clause, potentially leading to unauthorized data disclosure or modification. The vulnerability is catalogued as CWE‑89.

The issue impacts the PEAR framework component pearweb on any installation running a version prior to 1.33.0. The defect was remedied in release 1.33.0, so systems that have not applied this update remain vulnerable.

With a CVSS score of 6.9, the severity is moderate. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would need to reach the vulnerable code path, likely through a publicly accessible PHP interface that uses the IN clause. It is also inferred that no public exploits are known as of the latest data.