This vulnerability exists in the Mapper::orderBy function within the Mapper.h library component of the drogonframework drogon ORM Mapper. By manipulating the sort argument, an attacker can perform SQL injection remotely. The issue affects all drogon versions from 1.9.0 up to and including 1.9.13. The vendor was contacted but did not respond, and no patch or remediation is currently available. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute SQL injection attacks via the sort argument in the Mapper::orderBy function, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying workarounds such as input validation or restricting access to vulnerable functionality until an official fix is released.