Drogon CVE-2026-94143

Exploitation requires a Drogon-based application that passes attacker-controlled input into the sort argument of the ORM Mapper::orderBy API (typically a user-selectable sort column on a list/search endpoint). The library does not sanitize this argument, so any application exposing sort selection to untrusted users is at risk; applications that hardcode sort columns or whitelist them are not exploitable. The limiting factor is this usage pattern - the flaw is not a default-on remote endpoint but a library defect that must be reached through application code. No user interaction is needed once the sort parameter is attacker-reachable, and the referenced vector implies no authentication is required for the exposed endpoint itself.

This is a genuine but moderate-risk library-level SQL injection (CWE-89) in Drogon's ORM Mapper::orderBy. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L, score 6.9) treats it as remotely reachable without auth, and E:P confirms a proof-of-concept exists (matching the public gist reference). However, the real risk is conditional: this is an ORM API footgun, not a self-contained network service flaw - it only becomes exploitable when a downstream application passes attacker-controlled input into the orderBy sort argument, which is a per-deployment usage decision, not a default-on network endpoint. That gap means AC:L understates the practical attack complexity; I would rate AC:H because exploitability depends on the host application wiring untrusted input to sort. Conversely, the vendor's impact rating of all-Low is arguably conservative: a classic SQL injection reachable via a listing/sort parameter can enable full data exfiltration (ORDER BY-based / blind injection), so confidentiality could reach High where exploitable. No EPSS score and no KEV listing are provided, so there is no evidence of widespread or active exploitation - the only exploitation signal is public POC code. Net: a real, patch-worthy library defect that Drogon-based applications should treat seriously if they expose sort parameters, but not an emergency mass-exploitation event.

A web application built on Drogon exposes a list/search endpoint that lets clients choose a sort column and passes that value into Mapper::orderBy. An unauthenticated remote attacker supplies a crafted sort value that breaks out of the ORDER BY clause and injects SQL, enabling blind/ORDER BY-based extraction of database contents. Public exploit code is available (gist referenced in the advisory), lowering the barrier to reproduction.