A failure to properly parameterize input in the SearchUserTopUps and SearchAllTopUps functions of the model/topup.go file in QuantumNous new‑api allows an attacker to inject arbitrary SQL code when the self endpoint is called. Because the vulnerability is exploitable from a remote client, an attacker could read, modify, or delete data stored in the backend database, leading to a compromise of data confidentiality and integrity and potentially causing a denial‑of‑service condition if critical tables are corrupted.

QuantumNous new‑api versions up to and including 0.12.1 are affected. The vulnerability is present in the self endpoint of the new‑api component and does not appear to be limited to any particular deployment scenario beyond the presence of that endpoint.

The CVSS score of 5.3 indicates the issue has a moderate impact on security. EPSS information is not available, yet a public exploit has been released, showing that the weakness is actively used. The vulnerability is not listed in CISA KEV, but the combination of public exploits and remote trigger make it a realistic threat. An attacker does not need local access and can exercise arbitrary SQL commands against the database once the self endpoint is reachable.