CVE-2026-94144: Drogon Framework ORM SQL Injection Flaw

CVE-2026-94144 Overview

CVE-2026-94144 is a SQL injection vulnerability [CWE-74] in the Drogon C++ web framework affecting versions up to and including 1.9.13. The flaw resides in the makeCriteria function within orm_lib/src/Criteria.cc, part of the framework's Object-Relational Mapping (ORM) component. Attackers can manipulate the filter argument to inject arbitrary SQL statements against the backend database. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. A proof-of-concept exploit has been published publicly. The maintainers were contacted prior to disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can inject SQL through the ORM filter parameter, potentially exposing or modifying application database contents.

Affected Products

Drogon Framework versions up to and including 1.9.13
Component: ORM library (orm_lib/src/Criteria.cc)
Function: makeCriteria

Discovery Timeline

2026-09-21 - CVE-2026-94144 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94144

Vulnerability Analysis

Drogon is an open-source HTTP application framework written in C++ that provides an ORM abstraction for interacting with relational databases. The Criteria class constructs SQL WHERE clause fragments used by ORM queries. The makeCriteria function accepts a filter argument that is incorporated into the generated SQL statement without adequate sanitization or parameterization. Applications that pass user-controlled data into Criteria construction propagate that data directly into query strings, enabling SQL injection against the underlying database.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-74, specifically CWE-89]. The makeCriteria implementation in orm_lib/src/Criteria.cc concatenates the filter value into SQL text rather than binding it as a parameter. Any single-quote, comment sequence, or SQL keyword supplied by an attacker becomes part of the executed statement.

Attack Vector

The attack is network-reachable and requires no privileges. An attacker sends crafted input to any application endpoint that ultimately calls makeCriteria with attacker-influenced data. Successful exploitation can disclose database rows, modify records, or bypass application logic depending on how the resulting query is executed. Technical details are documented in the Drogon Issue #2576 tracker and the published GitHub Gist PoC.

No verified exploit code is reproduced here. Refer to the linked references for the sanitized proof-of-concept.

Detection Methods for CVE-2026-94144

Indicators of Compromise

HTTP request parameters containing SQL meta-characters such as ', --, /*, ;, or UNION SELECT targeting endpoints backed by Drogon ORM queries.
Database logs showing malformed or unexpectedly complex WHERE clauses originating from Drogon-generated statements.
Sudden spikes in database error messages, response time anomalies, or oversized result sets from Drogon-hosted services.

Detection Strategies

Perform code review across the application to identify calls to Criteria::makeCriteria or Criteria constructors that receive request-derived data.
Deploy a web application firewall with SQL injection signatures in front of Drogon-based services and enable request body inspection.
Enable database query logging and correlate anomalous statements with the originating HTTP request through application logs.

Monitoring Recommendations

Ingest Drogon application logs, reverse-proxy logs, and database audit logs into a centralized SIEM for correlation.
Alert on repeated 500-class responses or database exceptions from ORM code paths that reference Criteria.
Baseline normal query patterns for each Drogon service and alert on statements that deviate from parameterized forms.

How to Mitigate CVE-2026-94144

Immediate Actions Required

Inventory all applications and services built on Drogon and identify any release at or below version 1.9.13.
Audit application source code for any invocation of Criteria or makeCriteria that consumes untrusted input.
Restrict database account privileges used by Drogon applications to the minimum required for normal operation.

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry, and the maintainers did not respond to the disclosure. Monitor the Drogon Framework Repository and Drogon Issue #2576 for a fixed release. Upgrade immediately once a patched version becomes available.

Workarounds

Refactor application code to avoid passing untrusted input directly into Criteria; use parameterized query APIs where available.
Apply strict allow-list input validation on any request field that reaches ORM filter construction, rejecting SQL meta-characters.
Place a web application firewall in front of Drogon services with rules tuned to block SQL injection payloads targeting affected endpoints.
Reduce database privileges assigned to the Drogon service account to limit the blast radius of a successful injection.

bash

# Configuration example: minimal WAF rule concept (ModSecurity-style pseudo-rule)
SecRule ARGS "@rx (?i)(union\s+select|--|/\*|;\s*(drop|update|insert|delete))" \
    "id:1094144,phase:2,deny,status:403,msg:'Possible SQLi targeting Drogon ORM (CVE-2026-94144)'"