CVE-2026-94143
Received Received - Intake

SQL Injection in Drogon Framework ORM Mapper

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94143
EUVD
EUVD-2026-83836

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
drogonframework drogon From 1.8.x (inc) to 1.9.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94143 is a SQL injection vulnerability in the Drogon C++ web framework affecting versions 1.8.x through 1.9.13. The issue occurs in auto-generated RESTful controllers where user-controlled 'sort' query parameters are passed directly to the Mapper::orderBy() function without validation or sanitization. The column name is concatenated into SQL queries without escaping, allowing attackers to inject malicious SQL code.

Detection Guidance

To detect this vulnerability, check if your Drogon application uses auto-generated RESTful controllers with exposed 'sort' parameters. Test by sending crafted requests with SQL injection payloads in the 'sort' parameter, such as 'sort=1 AND 1=1' or 'sort=1 AND 1=2', to observe database behavior changes. Use tools like curl or Postman to send these requests to your API endpoints.

Impact Analysis

This vulnerability allows remote attackers to perform SQL injection attacks by manipulating the 'sort' parameter in API requests. Attackers can extract sensitive data like password hashes or other database contents without authentication. The exploit is possible through boolean-based blind SQL injection by modifying the ORDER BY clause.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected Drogon versions may face compliance breaches if sensitive data is exposed through SQL injection attacks.

Mitigation Strategies

Upgrade Drogon to a patched version if available. If not, disable auto-generated RESTful controllers or modify the 'sort' parameter handling to validate and sanitize inputs. Implement strict input validation for all query parameters and use parameterized queries instead of string concatenation in SQL operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart