Executive brief
Drogon is a C++ web application framework that uses an ORM layer to interact with databases. A vulnerability in the Criteria component allows remote attackers to inject arbitrary SQL code through the filter argument, bypassing database query safeguards and potentially exposing sensitive data or modifying database contents.
Technical details
The makeCriteria function in orm_lib/src/Criteria.cc directly concatenates user-controlled filter operator fields from JSON input into SQL WHERE clauses without proper sanitization. This SQL injection flaw is exploitable over the network without authentication, as the auto-generated RESTful controllers pass unsanitized filter JSON to the vulnerable function. An attacker can craft malicious filter operators to execute arbitrary SQL commands against the backend database.
Affected products
- Drogon Framework drogon up to 1.9.13
Timeline
- 2026-09-21: disclosed: Public disclosure via NVD and GitHub gist