CVE-2026-94144
Received Received - Intake

SQL Injection in Drogon Framework ORM

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94144
EUVD
EUVD-2026-83842

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
drogonframework drogon From 1.8.0 (inc) to 1.9.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94144 is a SQL injection flaw in the Drogon C++ web framework versions 1.8.x through 1.9.13. The issue occurs in the makeCriteria function where the 'operator' field in JSON filter criteria is improperly validated. Attackers can manipulate this field to inject malicious SQL operators directly into WHERE clauses of auto-generated SQL queries. This bypasses protections for column names and parameterized values, enabling unauthorized data access and extraction.

The vulnerability stems from direct concatenation of user-controlled input into SQL queries without sanitization. Exploitation requires no authentication and affects default configurations created by the drogon_ctl tool.

Detection Guidance

Check if your Drogon framework version is between 1.8.x and 1.9.13. Inspect auto-generated RESTful controllers for JSON filter criteria using the 'operator' field. Look for SQL query patterns where the operator value is directly concatenated into WHERE clauses without sanitization.

Impact Analysis
  • Unauthorized data access: Attackers can read sensitive information like password hashes or user data from the database.
  • Data extraction: Exploiters can extract arbitrary database contents using blind SQL injection techniques.
  • Permission bypass: Attackers may bypass row-level access controls to view restricted data.
  • Remote exploitation: The attack can be performed from remote without requiring authentication.
Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA. It enables unauthorized access to sensitive personal data, which could lead to data breaches. Organizations using affected Drogon versions may face regulatory penalties for failing to protect personal data adequately.

Mitigation Strategies

Upgrade Drogon to a version beyond 1.9.13. If upgrading is not possible, review and sanitize all JSON filter criteria inputs, especially the 'operator' field. Implement strict input validation and use parameterized queries to prevent SQL injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart