An unauthenticated remote SQL injection vulnerability in drogonframework drogon versions up to 1.9.7 poses a critical risk of unauthorized database access and potential data exfiltration.

The vulnerability is caused by improper sanitization of the sort argument within the Mapper::orderBy function in Mapper.h. An unauthenticated remote attacker can manipulate this parameter to inject malicious SQL queries into the backend database.

Successful exploitation allows an attacker to bypass authentication, access sensitive information, modify database records, or potentially gain administrative control over the underlying database server. Given the CVSS score of 7.3, this high-severity flaw threatens the confidentiality, integrity, and availability of any application utilizing the affected ORM component.

Immediate Action: Since no official patch is currently available, users should restrict access to applications using the affected Mapper component and validate all user-supplied input before it reaches the database layer.

Proactive Monitoring: Review database access logs for anomalous query patterns, such as unexpected syntax characters or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and filter malicious traffic directed at the application endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up referenced on GitHub.

Organizations currently utilizing affected versions of the drogon framework must treat this vulnerability with high priority. Because the vendor has not provided a direct fix, immediate code-level input validation and the implementation of robust WAF rules are essential to mitigate the risk of database compromise until an official security update is released.