The flaw exists in the makeCriteria function of the drogon ORM library. Malicious manipulation of the filter argument allows an attacker to inject arbitrary SQL, leading to unauthorized data access, modification, or deletion, compromising confidentiality, integrity, and availability of the underlying database. The core weakness corresponds to CWE‑74 and CWE‑89.

The vulnerability affects the drogonframework drogon library up to version 1.9.13. Any deployments using that version or any older release are exposed. It is confined to the ORM component implemented in orm_lib/src/Criteria.cc and does not impact other parts of the framework or newer releases beyond 1.9.13.

The CVSS score of 6.9 indicates high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation yet. However, the flaw can be triggered remotely, published exploits already exist, and the vendor did not respond, increasing the threat. Attackers can use standard SQL injection techniques to extract data or execute destructive commands if they can influence the filter argument.