Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

What happened?

Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server. The vulnerability, scored as CVSSv3.1 9.8 (Critical).

Key details

• Rapid7 discovered an unauthenticated SQL injection flaw in Channel Software WebAlliance eCommerce during red teaming exercises.
• The vulnerability allows reading sensitive database data and executing system commands if the database user has high privileges.
• The sUserID parameter in the GetUser SOAP method at /preapproval.asmx fails to escape user input, enabling injection.
• Microsoft SQL Server stacked queries allow injection of new SQL commands using a single quote and semicolon.
• If the database runs on the same server as the web app, ASPX files can be uploaded and executed for system command execution.

Summarised by SecOraLens from Rapid7. Always read the original source before acting. How SecOraLens verifies advisories.