CVE-2026-108065: Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker only needs network access to the SOAP GetUser method at /preapproval.asmx. No authentication or user interaction is required, and exploitation uses a crafted sUserID parameter containing a single quote and a stacked SQL query.
Which systems are exposed?
Systems running Channel Software WebAlliance eCommerce are potentially exposed if the /preapproval.asmx endpoint and its GetUser SOAP method are reachable by an attacker. The affected product version is not specified in the available data.
What could compromise look like?
Successful exploitation can allow an attacker to read and modify data in the backend Microsoft SQL Server and may allow command execution. Requests to the GetUser method with anomalous sUserID values, especially values containing single quotes or stacked SQL statements, may indicate attempted exploitation.