Drogon CVE-2026-94144

Exploitation requires a Drogon-based application (versions up to 1.9.13) that passes attacker-controllable input into the ORM Criteria 'filter' argument handled by makeCriteria without parameterization or sanitization. This is a library-level footgun: the framework itself is only exploitable through an application code path that forwards untrusted input into ORM criteria, so applications that use parameterized values or never expose the filter argument to user input are NOT vulnerable. Where such a path exists and is reachable over the network, no authentication or user interaction is needed. Limiting factors: the required unsafe usage pattern is application-specific and non-universal, no official patch exists (vendor unresponsive), and exploitation is over the network against whatever endpoint exposes the filter.

This is a moderate-risk SQL injection in the Drogon C++ web framework's ORM layer (makeCriteria in Criteria.cc), best characterized as a library footgun rather than a turnkey remote exploit. The vendor CVSS 4.0 vector (5.5) rates AV:N/AC:L/PR:N/UI:N with all impacts Low (VC:L/VI:L/VA:L), and E:P confirms a proof-of-concept exists. Signals conflict: SSVC 'exploitation' is at Proof-of-Concept (POC published on GitHub gist), there is no EPSS score and no CISA KEV listing, so this is 'publicly available exploit code exists' - NOT active exploitation. The AC:L/PR:N framing overstates real-world reachability: the flaw is only exploitable if the consuming application routes untrusted, attacker-controlled input directly into the Criteria filter argument, which is a per-application coding decision, so realistic attack complexity is higher (AC:H) and many deployments are simply not vulnerable. Conversely, the all-Low impact rating likely understates a successful injection: SQLi against an ORM typically yields full database read (VC:H). Net: not an urgent internet-wide priority, but a real defect that matters for any Drogon app that passes user input into ORM filters. Vendor did not respond to disclosure, so no official patch is confirmed at time of analysis.

A public PoC (GitHub gist by researcher 2H-K) demonstrates the injection. In a Drogon-based application that passes user-supplied input (e.g., a search/filter query parameter) into the ORM Criteria filter argument, a remote attacker submits a crafted filter value that breaks out of the intended predicate and injects arbitrary SQL, reading or tampering with database contents. Exploitation requires no authentication where the vulnerable endpoint is exposed, but only works if the application actually forwards untrusted input into makeCriteria without sanitization.