Executive brief
Siam Ordering is an ordering management system used by merchants and administrators to process transactions and manage accounts. A SQL injection vulnerability in the admin interface allows authenticated users with admin privileges to bypass input validation and execute arbitrary database commands, potentially exposing sensitive data such as passwords, account information, and transaction records.
Technical details
The vulnerability is a SQL injection flaw in multiple MyBatis mapper files (AdminMapper.java, MerchantWithdrawRecordMapper.java, MemberWithdrawRecordMapper.java, and 40+ others) that use unsafe ${} string concatenation instead of parameterized #{} queries. The vulnerable code directly concatenates user-controlled input (such as username, mobile, nickname, auditReason, and orderNo fields) into SQL WHERE clauses without sanitization. Attack requires valid administrator authentication and network access to the admin API endpoint (/api-user/rest/admin/list). An authenticated attacker can inject malicious SQL to extract database contents, modify records, or execute time-based attacks. The fix involves replacing all ${} placeholders with #{} parameterized queries and using CONCAT() for LIKE operations.
Affected products
- Siam Siam Ordering 1.0.0
Timeline
- 2026-07-26: disclosed: Vulnerability reported on GitHub
- 2026-09-09: advisory: Published CVE-2026-71808