CVE-2026-71808: SQL Injection
A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be remotely authenticated to the Siam Ordering siam-server application. The available information does not identify which authenticated roles or privileges are required.
Which code areas are implicated?
The issue involves ${} string concatenation in AdminMapper.java and multiple Mapper files, including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java. This pattern can allow attacker-controlled input to be incorporated directly into SQL commands.
How can I determine whether my deployment is affected?
Deployments using Siam Ordering siam-server version 1.0.0 are identified as affected. Review Mapper files for ${} SQL string concatenation, particularly the named mapper classes, and determine whether values reaching those expressions can be influenced by authenticated users.