CVE Alert: CVE-2026-94143 – drogonframework

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early this disclosure but did not respond in any way.

**Risk verdict:** This is a remotely exploitable, publicly demonstrated flaw that warrants urgent remediation for internet-facing applications, although there is no evidence here of active exploitation or KEV listing.

**Why this matters:** Successful exploitation could enable unauthorised database reads, modification or deletion, depending on the application’s database permissions and exposed functionality. The most realistic attacker goals are data theft, tampering with application records, service disruption, and using compromised database access to support further intrusion.

**Most likely attack path:** An attacker sends crafted sorting input to an endpoint that passes user-controlled values into the ORM ordering function; no authentication, user interaction or complex setup is indicated. Network reachability and low attack complexity make public APIs and web applications the principal concern. Scope appears unchanged, so direct impact is concentrated in the affected service and its connected database, though stolen credentials or data could enable subsequent lateral movement.

**Who is most exposed:** Internet-facing C++ services built with the affected ORM component, especially APIs offering searchable, sortable listings and using powerful shared database accounts. Internal services become higher risk where network segmentation is weak or untrusted users can reach them.

Alert on unusual SQL metacharacters or syntax in sort/order parameters.

Review database logs for unexpected `ORDER BY` structures, errors, or schema enumeration.

Correlate anomalous sorting requests with bulk reads, write activity, or elevated query volume.

Identify deployments using the affected ORM mapper and externally reachable sortable endpoints.

Mitigation and prioritisation:

Apply the vendor or maintainer’s fixed release as soon as validated; prioritise exposed services.

Treat the public exploit as requiring accelerated change review, even without confirmed exploitation.

Allow-list sortable columns and directions; never concatenate client input into SQL clauses.

Restrict database accounts, segment databases, and add WAF/API validation as compensating controls.

EPSS and SSVC status are not provided; reassess priority when telemetry or authoritative scoring becomes available.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.