PEAR SQL Injection Vulnerability in Karma Queries Prior to Version 1.33.0

A SQL injection vulnerability has been identified in PEAR's karma queries, prior to version 1.33.0. The issue arises from unsafe literal substitution in 'IN (...)' lists, allowing for injection if the levels list can be manipulated by an attacker.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users can upgrade to PEAR version 1.33.0 or later to address this vulnerability.