drogon vulnerabilities

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability in the drogon library (up to version 1.9.13) affects the makeCriteria function in orm_lib/src/Criteria.cc (ORM component). Manipulation of the filter argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in the drogon library (up to version 1.9.13) affects the Mapper::orderBy function in Mapper.h (ORM Mapper component). Manipulation of the sort argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.