CVE-2026-71808 Details
Description
A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).
A SQL injection vulnerability has been identified in Siam Ordering version 1.0.0. This issue allows remote authenticated attackers to execute arbitrary SQL commands by exploiting unsafe string concatenation in MyBatis Mapper files, including AdminMapper, MerchantWithdrawRecordMapper, and MemberWithdrawRecordMapper.
To address this vulnerability, all instances of '${}' should be replaced with '#{}' to use parameterized queries. For LIKE queries, concatenate the wildcard characters with the parameter using 'CONCAT'. Additionally, conduct a thorough audit of all Mapper files and consider implementing Web Application Firewall (WAF) rules to block common SQL injection payloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/W000i/vuln/issues/12 | CISA-ADP | ExploitIssue TrackingRemedy |
| https://github.com/W000i/vuln/issues/12 | [email protected] | ExploitIssue TrackingRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Siam Ordering | 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |