{"id":"CVE-2026-94143","published":"2026-09-21T06:17:02.003","lastModified":"2026-09-21T22:16:59.717","description":"A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":7.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwes":["CWE-74","CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/2H-K/33f46c954fd3ed16b32eeddd598f90cf","tags":[]},{"url":"https://github.com/drogonframework/drogon/","tags":[]},{"url":"https://github.com/drogonframework/drogon/issues/2575","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-94143","tags":[]},{"url":"https://vuldb.com/submit/893923","tags":[]},{"url":"https://vuldb.com/vuln/408058","tags":[]},{"url":"https://vuldb.com/vuln/408058/cti","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/2H-K/33f46c954fd3ed16b32eeddd598f90cf","tags":[]},{"url":"https://github.com/drogonframework/drogon/","tags":[]},{"url":"https://github.com/drogonframework/drogon/issues/2575","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows SQL injection through manipulation of the sort argument in the Mapper::orderBy function, posing a high risk due to remote exploitability.","exploitability":"Exploitation is relatively straightforward with public exploits available; requires access to the application's input parameters.","blast_radius":"If exploited, could lead to data theft or corruption affecting users and systems interacting with the vulnerable application.","remediation":"Update drogonframework to version 1.9.14 or later to mitigate the vulnerability.","tags":["sql-injection","remote-exploit","orm","security-update"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:16:21.225Z"}}