Forwarded from Taiwan Computer Emergency Response Coordination Center Cybersecurity Information Alert TWCERTCC-200-202609-00000007

[Content Description]
【Interinfo｜DreamMaker - SQL Injection】(CVE-2026-85540，CVSS：8.8) Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.
【Interinfo｜DreamMaker - Reflected Cross-site Scripting】(CVE-2026-85541，CVSS：5.4) Authenticated remote attackers can exploit malicious websites to execute arbitrary JavaScript code in users' browsers. For detailed vulnerability information, please refer to "Vulnerability Information".

[Affected Platforms]
Dreammaker

[Recommended Measures]
【CVE-2026-85540】 For self-developed functions using the SQLBuilder component, it is recommended to uniformly use the system's existing SQLBuilder component for SQL composition, parameter processing, and database operations when performing database queries or modifications. Directly concatenating external input data, form parameters, or URL parameters into SQL commands as strings should be avoided to reduce the risk of SQL Injection(SQL injection) vulnerabilities caused by improper handling in self-developed programs. Using SQLBuilder or other standard components with parameterized query mechanisms can further strengthen input data processing and SQL execution security, and reduce the possibility of applications being subject to malicious SQL command injection attacks. The relevant component development and usage manuals can be obtained through the company's customer service system.

【CVE-2026-85541】
Solution 1: Restrict or disable baServer3 If the system has been updated to a version after April 2026 and before June 2026, even if Java Composer 2.2 is still currently being used, the WLIST whitelist mechanism(WhiteList) can first be used to restrict the access sources of jform and baServer3 to prevent unauthorized users from directly accessing the relevant functions. The relevant WLIST operation documentation can be obtained through the company's customer service system. If there is currently no need to use baServer3 for system development, maintenance, or management, you can also directly move, disable, or rename: servlet/baServer3.class. After this component is removed, in principle, the normal operation of existing system applications will not be affected, but the related management or development functions can no longer be used through this Servlet.

Solution 2: Update to Java Composer Server 2.3 The current version and update date of Java Composer Server on the server side can be confirmed through the following URL, or determined through the information displayed when Java Composer is started: http://server-ip/servlet/baServer3

[References]
1. https://www.twcert.org.tw/tw/cp-132-11183-06a5e-1.html