Posting Date: 2026/09/10

【Vulnerability Alert】[TLP CLEAR] InterNet｜DreamMaker - SQL Injection

  • Subject: 【Vulnerability Alert】[TLP CLEAR] InterNet｜DreamMaker - SQL Injection


  • Description:
    • Forwarding Taiwan Computer Emergency Response Team / Coordination Center Cybersecurity Alert TWCERTCC-200-202609-00000007
    • 【InterNet｜DreamMaker - SQL Injection】(CVE-2026-85540, CVSS: 8.8) Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database content.
    • 【InterNet｜DreamMaker - Reflected Cross-site Scripting】(CVE-2026-85541, CVSS: 5.4) Authenticated remote attackers can use malicious websites to execute arbitrary JavaScript code on the user's browser. For detailed vulnerability descriptions, please refer to “Vulnerability Information”.
  • Affected Platforms:
    • Dreammaker
  • Recommended Actions:
    • 【CVE-2026-85540】 Use SQLBuilder Component: For self-developed features involving database query or modification functions, it is recommended to uniformly use the system's existing SQLBuilder component for SQL assembly, parameter handling, and database operations. Direct string concatenation of external input data, form parameters, or URL parameters into SQL commands should be avoided to mitigate the risk of SQL Injection vulnerabilities caused by improper handling in custom code. Utilizing SQLBuilder or other standard components with parameterized query mechanisms can further enhance the security of input data processing and SQL execution, while reducing the likelihood of malicious SQL injection attacks on the application. Relevant component development and user manuals can be requested through our customer service system.
    • 【CVE-2026-85541】
    • Solution 1: Restrict or disable baServer3. If the system has been updated to a version released after April 2026 and before June 2026, even if Java Composer 2.2 is still in use, the access sources to jform and baServer3 can first be restricted via the WLIST whitelist mechanism (WhiteList) to prevent unauthorized users from directly accessing related functions. Relevant WLIST operation documents can be requested through our customer service system. If there is currently no demand in development, maintenance, or management to use baServer3, you may also directly relocate, disable, or rename: servlet/baServer3.class. In principle, removing this component will not affect the normal execution of existing system applications, but the management or development functions associated with that Servlet will no longer be available.
    • Solution 2: Update to Java Composer Server 2.3. You can verify the current version and update date of the server-side Java Composer Server via the following URL, or determine it through the information displayed when Java Composer starts: http://server-ip/servlet/baServer3
  • References:
    1. https://www.twcert.org.tw/tw/cp-132-11183-06a5e-1.html

Computer and Communication Center
Network System Division