CVE-2026-94143: Drogon C++ Framework SQL injection in ORM Mapper orderBy

Executive brief

Drogon is a C++ web application framework used to build web services and REST APIs. A SQL injection vulnerability in the ORM Mapper's orderBy function allows remote attackers to manipulate database queries through unsanitized sort parameters, potentially leading to unauthorized data access or modification without requiring authentication.

Technical details

The Mapper::orderBy function in drogon's ORM layer fails to properly validate or escape user-controlled sort parameters, allowing SQL injection via the query parameter. The vulnerable code concatenates the sort argument directly into SQL queries using formattedString() without parameterized query protection. An unauthenticated remote attacker can exploit this by sending crafted sort parameters to auto-generated RESTful controller endpoints.

Affected products

• drogonframework drogon up to 1.9.13

Timeline

• 2026-09-21: disclosed
• other: Exploit code publicly available; vendor non-responsive to early disclosure

References

• https://gist.github.com/2H-K/33f46c954fd3ed16b32eeddd598f90cf
• https://github.com/drogonframework/drogon/