CVE-2026-71808

CVE-2026-71808 is a SQL injection flaw in Siam Ordering's siam-server version 1.0.0, caused by the use of ${} string concatenation instead of parameterized queries in MyBatis mapper files, including AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java. A remote attacker holding valid low-privilege credentials can submit crafted input to affected admin, member-withdrawal, or merchant-withdrawal endpoints, injecting arbitrary SQL into the concatenated statements. Successful exploitation gives high-impact control over the backend database's confidentiality, integrity, and availability (CVSS 3.1 8.8), potentially exposing or altering member, merchant, and financial records. All deployments running siam-server 1.0.0 are affected, with no fixed version yet documented. There are no reports of in-the-wild exploitation, no known public proof-of-concept, and the flaw is not listed in CISA's KEV.

What to do: Upgrade siam-server to a fixed release when one becomes available (no patched version is documented yet), or patch the affected mapper files to replace ${} concatenation with parameterized #{} placeholders. In the interim, restrict the admin/merchant interface to trusted networks and minimal authenticated accounts, and consider WAF SQL-injection rules. Review database and application logs for anomalous SQL errors or unexpected queries touching admin, member-withdrawal, and merchant-withdrawal functions.