CVE-2026-94143: Drogon Framework ORM Mapper SQLI Vulnerability

CVE-2026-94143 Overview

CVE-2026-94143 is a SQL injection vulnerability in the Drogon C++ web framework versions up to 1.9.13. The flaw resides in the Mapper::orderBy function within Mapper.h, part of the ORM Mapper component. Attackers can manipulate the sort argument to inject arbitrary SQL statements into database queries. Exploitation requires no authentication or user interaction and can be performed remotely over the network. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). Public exploit code is available, and the maintainers did not respond to disclosure attempts.

Critical Impact
Remote attackers can inject SQL queries through the sort parameter of Mapper::orderBy, potentially exposing or modifying database contents in applications built on Drogon.

Affected Products

Drogon Framework versions up to and including 1.9.13
Applications using the Mapper::orderBy ORM function with user-controlled sort input
C++ web services built on the Drogon ORM Mapper component

Discovery Timeline

2026-09-21 - CVE-2026-94143 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94143

Vulnerability Analysis

The vulnerability lives in the Mapper::orderBy method exposed by Drogon's ORM layer through Mapper.h. Applications call orderBy to append an ORDER BY clause to a generated SQL statement. When the framework accepts the sort argument without proper neutralization, attacker-controlled input becomes part of the query string. This allows arbitrary SQL syntax to reach the database engine unchanged.

Because ORDER BY clauses are commonly built from user-facing controls such as column selectors and sort direction toggles, the parameter is often reachable from unauthenticated HTTP endpoints. Public proof-of-concept code demonstrates end-to-end exploitation. See the Drogon Issue #2575 tracker for reproduction details.

Root Cause

The Mapper::orderBy implementation concatenates or interpolates the sort argument into the generated SQL without validating that the value corresponds to a known column identifier or sort direction. Parameterized query bindings do not apply to ORDER BY targets in most database engines, so column names must be validated against an allowlist. Drogon omits this check, satisfying the conditions of [CWE-74].

Attack Vector

An unauthenticated remote attacker submits a crafted sort value to any application endpoint that forwards user input into Mapper::orderBy. The injected payload can terminate the intended clause and append additional SQL, such as UNION SELECT statements, subqueries, or stacked queries where the backend permits them. Confidentiality, integrity, and availability of database contents are all in scope depending on the underlying DBMS privileges granted to the application.

No authenticated exploit code is required for demonstration. Reference material is available at the GitHub Gist Example Code and the VulDB CVE-2026-94143 entry.

Detection Methods for CVE-2026-94143

Indicators of Compromise

HTTP requests containing SQL metacharacters (single quotes, semicolons, --, UNION, SELECT) inside sort, order, or orderBy query parameters
Database logs showing unexpected ORDER BY clauses referencing subqueries, functions, or non-column expressions
Anomalous UNION-based queries or information-schema lookups originating from application service accounts
Application error logs revealing SQL syntax errors tied to endpoints that use the Drogon ORM

Detection Strategies

Enable database query logging and search for ORDER BY clauses containing SQL keywords, parentheses, or comment markers
Deploy web application firewall (WAF) signatures that flag SQL injection patterns in sort-related query parameters
Perform static code review of Drogon-based codebases to locate every call to Mapper::orderBy fed by request data
Run dynamic scans against endpoints that accept sort parameters using fuzzers configured for ORDER BY injection payloads

Monitoring Recommendations

Correlate spikes in database errors with the source HTTP requests to identify probing activity
Monitor outbound query volume from application accounts for unexpected data extraction patterns
Alert on database sessions that touch information_schema, pg_catalog, or system tables from application service accounts
Track authentication and role usage on the database to detect privilege abuse following a successful injection

How to Mitigate CVE-2026-94143

Immediate Actions Required

Inventory all Drogon deployments and identify code paths that pass request data into Mapper::orderBy
Wrap orderBy calls with an allowlist that validates the sort value against known column names and directions (ASC/DESC)
Deploy WAF rules to block SQL metacharacters in parameters bound to sorting logic until code fixes are in place
Reduce the database privileges granted to application service accounts to limit blast radius

Patch Information

No vendor patch is available at time of publication. The vendor was contacted before disclosure and did not respond. Track upstream progress in the Drogon Framework Repository and Drogon Issue #2575 for a future fix.

Workarounds

Replace direct calls to Mapper::orderBy(userInput) with a lookup that maps sanitized keys to fixed column identifiers
Reject any sort parameter value that does not match ^[A-Za-z_][A-Za-z0-9_]*$ before it reaches the ORM
Split direction from column name and validate direction against a two-value enum (ASC, DESC)
Apply DBMS-level query timeouts and row limits to reduce the impact of injected data extraction attempts

bash

# Example allowlist enforcement before invoking Mapper::orderBy
allowed_columns=("id" "created_at" "username" "status")
allowed_directions=("ASC" "DESC")
# Reject the request if $sort_column or $sort_direction is not in the allowlist