CVE-2026-94143: drogonframework drogon ORM Mapper Mapper.h orderBy sql injection
A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects drogonframework/drogon versions up to 1.9.13 when the ORM Mapper component uses Mapper::orderBy with a manipulable sort argument. The provided data does not identify a fixed version.
What does an attacker need to exploit this?
An attacker needs a way to influence the sort argument passed to Mapper::orderBy. Exploitation can be performed remotely and requires no privileges or user interaction according to the supplied vector.
Is public exploit code available?
Yes. The vulnerability data states that an exploit is public and may be used.
What can be done while a vendor fix is unavailable?
Do not pass untrusted input directly to Mapper::orderBy's sort argument. Restrict ordering to an application-defined allowlist of expected column names and sort directions before calling the method.