A flaw in the drogon framework’s ORM Mapper::orderBy function allows an attacker to manipulate the sort parameter, enabling arbitrary SQL injection. The vulnerability permits execution of malicious SQL commands that can read, modify, or delete data stored in the database. It is based on unsanitized input handling (CWE‑74 and CWE‑89). The exposed path can be reached remotely via the application’s interfaces, and an exploit is publicly known. The CVSS score of 6.9 reflects a moderate but non‑trivial risk.

Systems running drogon framework version 1.9.13 or earlier are affected. The vulnerability resides in the Mapper.h component of the ORM module and impacts any application that uses the vulnerable version of the framework. No other versions are explicitly listed as affected.

The vulnerability can be leveraged by sending crafted ORDER BY clauses to the application’s API or user input fields, leading to SQL injection. Because the flaw is remote and publicly disclosed, the likelihood of exploitation is significant until a patch or mitigation is applied. There is no EPSS data, but the moderate CVSS and lack of vendor response increase the overall risk. The vulnerability is not in the CISA KEV catalog.