Description

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-21T07:16:53.600Z",
  "pubdate": "2026-09-21T07:16:53.600Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the Drogon framework, specifically within the ORM component's Criteria handling logic.\nThe vulnerability resides in the makeCriteria function located in orm_lib/src/Criteria.cc, which fails to properly sanitize the 'filter' argument before constructing database queries.\nThe flaw allows remote, unauthenticated attackers to manipulate query parameters, potentially leading to unauthorized data exfiltration, modification, or deletion.\nAffected versions include all releases of the drogonframework drogon up to and including 1.9.13.\nGiven that public exploit code exists and the vendor has not provided a response or patch, the risk to production environments utilizing affected versions of this ORM is high.\nSystem compromise is possible without prior authentication, and the vulnerability is directly reachable via network-accessible application endpoints.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw stemming from improper input validation within the ORM abstraction layer. Specifically, the function makeCriteria in the file orm_lib/src/Criteria.cc processes user-supplied filter parameters without sufficient sanitization or the use of parameterized queries.\nThe root cause involves the direct concatenation or unsafe parsing of the 'filter' argument into a raw SQL string. By crafting a malicious input containing SQL command syntax, an attacker can break out of the intended query structure. This allows for the injection of arbitrary SQL commands that are subsequently executed by the database management system with the permissions of the application's database user.\nThe attack flow proceeds as follows: 1) An attacker identifies an API endpoint or request handler that utilizes the Criteria class to filter database records. 2) The attacker crafts a request containing a specially formatted string in the 'filter' argument, incorporating SQL meta-characters or keywords (e.g., UNION SELECT, OR 1=1). 3) The application forwards this unsanitized string to the makeCriteria function. 4) The function constructs the SQL statement incorporating the malicious payload. 5) The application executes the resulting query against the backend database. 6) The database processes the injected commands, resulting in unauthorized data access or modification.\nBecause the attack occurs at the application-database interface, the impact is severe. An attacker can perform 'blind' SQL injection to infer data structure and contents, or bypass authentication mechanisms that rely on database lookups. If the application's database user has broad permissions, the impact could extend to complete data loss or the execution of administrative stored procedures.\nThis vulnerability is classified as remote and unauthenticated, meaning no special privileges or prior sessions are required to trigger the flaw, provided the vulnerable endpoint is exposed to the network. Exploitation is facilitated by the existence of public exploit scripts, which lower the bar for attackers to weaponize the flaw against unpatched systems.\nThe vulnerable code path is embedded deep within the ORM component of the framework, making it a pervasive issue for any application relying on the Criteria-based query building mechanism."
}