CVE-2026-9305 Overview
CVE-2026-9305 is a SQL injection vulnerability in QuantumNous new-api versions up to 0.12.1. The flaw resides in the SearchUserTopUps and SearchAllTopUps functions within model/topup.go, exposed through the self endpoint component. Attackers can manipulate input to inject arbitrary SQL statements remotely. A public exploit has been released, and the vendor did not respond to early disclosure attempts. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
Critical Impact
Remote authenticated attackers can execute arbitrary SQL queries against the application database, exposing top-up records and potentially other tables in the same schema.
Affected Products
- QuantumNous new-api versions up to and including 0.12.1
- Component: self Endpoint
- File: model/topup.go
Discovery Timeline
- 2026-05-23 - CVE-2026-9305 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9305
Vulnerability Analysis
The vulnerability exists in the search functionality for top-up transactions within QuantumNous new-api. The SearchUserTopUps and SearchAllTopUps functions in model/topup.go construct SQL queries using attacker-controllable input without proper parameterization or sanitization. An attacker with low privileges can send a crafted request through the self endpoint to inject SQL syntax into the underlying database query.
The attack is remotely exploitable over the network and requires only low-level authentication. Successful exploitation allows extraction of database content, including financial top-up records associated with users. A proof-of-concept is publicly available on GitHub Gist, increasing the likelihood of opportunistic exploitation.
Root Cause
The root cause is improper neutralization of special elements passed to the SQL interpreter [CWE-74]. Search parameters accepted by SearchUserTopUps and SearchAllTopUps are concatenated directly into SQL statements rather than bound through parameterized queries or prepared statements. This pattern violates secure coding practices for database access in Go applications using ORMs or raw SQL drivers.
Attack Vector
An authenticated attacker sends an HTTP request to the self endpoint, supplying malicious input to the top-up search parameters. The injected payload alters the SQL query semantics, enabling boolean-based, union-based, or time-based extraction techniques. Because the vulnerable functions operate on top-up records, attackers can enumerate user financial data and pivot to other tables through UNION-based extraction. Refer to the GitHub Gist PoC Repository for technical details of the exploitation pattern.
Detection Methods for CVE-2026-9305
Indicators of Compromise
- Unusual query patterns in database logs containing UNION SELECT, SLEEP(, or boolean tautologies tied to top-up search endpoints
- HTTP requests to the self endpoint containing SQL metacharacters such as single quotes, semicolons, or comment markers (--, /*)
- Repeated requests from the same authenticated session with varying payloads against SearchUserTopUps or SearchAllTopUps
Detection Strategies
- Deploy web application firewall rules to inspect request parameters targeting the top-up search endpoints for SQL injection signatures
- Enable database query logging and alert on syntactically anomalous queries originating from the new-api service account
- Correlate authentication events with high-volume search requests to identify reconnaissance behavior
Monitoring Recommendations
- Monitor application logs for HTTP 500 responses and SQL error messages returned from top-up endpoints
- Track outbound data volume from the database server to identify bulk extraction attempts
- Review audit logs for low-privileged accounts performing administrative-scope searches
How to Mitigate CVE-2026-9305
Immediate Actions Required
- Restrict network access to the QuantumNous new-api self endpoint to trusted networks until a patched release is available
- Audit authenticated user accounts and revoke unused or untrusted credentials that could be abused for exploitation
- Deploy WAF signatures to block SQL metacharacters in top-up search parameters
Patch Information
No official vendor patch is available at the time of publication. The vendor was contacted but did not respond to disclosure. Organizations running QuantumNous new-api 0.12.1 or earlier should monitor the project repository for updates and apply community patches that introduce parameterized queries in model/topup.go.
Workarounds
- Apply a reverse proxy rule to reject requests to the self endpoint containing SQL syntax tokens
- Limit database account privileges used by new-api to read-only access on non-sensitive tables where feasible
- Implement an internal patch replacing string concatenation in SearchUserTopUps and SearchAllTopUps with parameterized query bindings
# Example WAF rule (ModSecurity) to block SQL metacharacters on top-up search
SecRule REQUEST_URI "@contains /api/topup/search" \
"id:1009305,phase:2,deny,status:403,\
chain,msg:'CVE-2026-9305 SQLi attempt blocked'"
SecRule ARGS "@rx (?i)(union\s+select|sleep\(|--|/\*|';)" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
