| शीर्षक | drogonframework drogon 1.9.13 SQL Injection |
|---|
| विवरण | A vulnerability, which was classified as high severity, has been found in drogon up to 1.9.13. Affected by this issue is the orderBy() functionality of the ORM Mapper component, as reachable through the sort query parameter in controllers generated by the drogon_ctl RESTful controller template. The manipulation of the unsanitized column name leads to SQL injection via unsafe string concatenation in the ORDER BY clause. The attack may be launched remotely without authentication. No fix is currently available. It is recommended to apply input validation on the sort parameter and avoid passing untrusted input to Mapper::orderBy() until an upstream patch is released. The identifier of this vulnerability is pending assignment. |
|---|
| स्रोत | ⚠️ https://gist.github.com/2H-K/33f46c954fd3ed16b32eeddd598f90cf |
|---|
| उपयोगकर्ता | hacja (UID 92094) |
|---|
| सबमिशन | 17/07/2026 10:55 AM (2 महीनों पहले) |
|---|
| संयम | 20/09/2026 10:15 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408058 [drogonframework drogon तक 1.9.13 ORM Mapper Mapper.h Mapper::orderBy sort SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|