Description

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-09T21:17:03.813Z",
  "pubdate": "2026-09-09T21:17:03.813Z",
  "executiveSummary": "Siam Ordering (siam-server) version 1.0.0 contains a critical SQL Injection vulnerability arising from the improper use of MyBatis string substitution syntax. This vulnerability allows remote, authenticated attackers to execute arbitrary SQL commands against the underlying database.\nThe vulnerability is present in multiple persistence layer components, including AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java. By manipulating input parameters that are passed into dynamic SQL queries, an attacker can bypass intended query logic, leading to unauthorized data exfiltration, modification, or deletion.\nThe risk implication is significant as it provides attackers with direct interaction with the database server, potentially leading to full compromise of sensitive business and user information. Successful exploitation requires an authenticated session, though the impact ranges from sensitive data exposure to complete database takeover depending on the privileges of the database service account.\nThe vulnerability stems from the use of the '${}' syntax in MyBatis mappers, which performs direct string concatenation rather than parameterized prepared statements. This flaw bypasses the database's built-in protections against SQL injection attacks.",
  "technicalDetails": "The root cause of this vulnerability is the use of MyBatis '${}' syntax within the application's XML mapper files or Java interface annotations. In MyBatis, the '${}' syntax functions as a raw string substitution operator, directly embedding the provided input into the SQL statement before it is sent to the database driver for execution. Conversely, the '#{}' syntax should be utilized for parameter substitution, as it triggers the use of PreparedStatement objects, ensuring inputs are properly escaped and treated as literal values rather than executable code.\nThe vulnerability is localized to several Mapper files, specifically AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java. Because these components handle administrative and financial transaction data, the exposure is high-severity.\nThe attack flow proceeds as follows: An authenticated attacker identifies an input vector—such as a search query, filter parameter, or sorting identifier—that is processed by one of the vulnerable Mapper files. The attacker crafts a malicious payload containing SQL command delimiters (e.g., single quotes, comments, or stacked query operators like ';'). When the application processes the request, the ${} expression replaces the placeholder with the attacker's string without sanitization. The resulting SQL string is then parsed and executed by the database management system as part of the intended query.\nFor instance, if a Mapper uses 'SELECT * FROM users WHERE username = ${username}', an attacker providing 'admin' OR 1=1' as the username parameter transforms the query into 'SELECT * FROM users WHERE username = 'admin' OR 1=1'. This allows the attacker to bypass authentication logic or dump the entire user table.\nThe payload behavior is limited only by the privileges of the database user account configured for the application and the database engine's support for stacked queries. If stacked queries are permitted, an attacker could potentially execute 'DROP TABLE' commands, escalate privileges by modifying Admin accounts, or leverage database-specific features to read or write to the file system. Because this vulnerability exists in components managing withdrawals (MerchantWithdrawRecordMapper, MemberWithdrawRecordMapper), it is particularly susceptible to financial fraud and unauthorized transaction manipulation.\nThis vulnerability is reachable via remote network access, contingent upon successful authentication. Given the nature of the target files, the attack surface includes any authenticated user account, representing a significant risk to the integrity and confidentiality of the Siam Ordering platform."
}