Description

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-21T06:17:02.003Z",
  "pubdate": "2026-09-21T06:17:02.003Z",
  "executiveSummary": "A SQL injection vulnerability exists in the drogonframework drogon ORM Mapper component, specifically within the Mapper::orderBy function. This vulnerability allows remote, unauthenticated attackers to manipulate the 'sort' argument to execute arbitrary SQL commands against the backend database.\nThe vulnerability affects all versions of the drogonframework up to 1.9.13. By injecting malicious SQL syntax through the 'sort' parameter, an attacker can bypass standard query logic, potentially leading to unauthorized data exfiltration, database modification, or complete compromise of the underlying data store.\nGiven that the exploit is publicly available and the vendor has not provided a response or a patch, systems utilizing this version of the ORM Mapper are at high risk. The vulnerability necessitates immediate defensive measures to sanitize inputs or restrict the functionality of the affected component to prevent remote exploitation.",
  "technicalDetails": "The vulnerability resides within the Mapper::orderBy function located in the Mapper.h header file of the drogonframework ORM. The root cause is the improper neutralization of special elements used in an SQL command within the 'sort' argument. The implementation of this function fails to properly validate or sanitize the string input provided by the user before appending it directly into the generated SQL query string.\nThe attack flow initiates when an application using the drogon ORM processes user-supplied input intended for sorting database results. An attacker crafts a malicious payload containing SQL meta-characters or SQL keywords—such as UNION SELECT, boolean-based inference injections, or stacked queries—and passes this input into the 'sort' parameter of the affected application interface.\nBecause the Mapper::orderBy function does not employ parameterized queries or strict allow-listing for the 'sort' argument, the ORM constructs an SQL statement that includes the attacker's injected input. The database engine then interprets the injected string as part of the operational command rather than as a literal value for sorting. This leads to the execution of unintended queries with the same privileges as the database user configured for the application.\nExploitation is possible remotely without the need for authentication, as the vulnerable path is reachable via standard ORM interaction patterns. Post-exploitation impact is severe, as the attacker can perform data exfiltration (dumping tables), modify sensitive records, or, depending on the database configuration and permissions, perform administrative actions within the database management system. This facilitates a complete breach of confidentiality, integrity, and availability of the application's data layer."
}