# Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

DevFeed: [Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce](<https://devfeed.tech/articles/unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce-87098.md>)

Original publisher: [Read original article](<https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce>)

Author: Marcus Chang

Published: 2026-10-14T12:47:05Z

Content type: news

Language: en

Sources: [Rapid7 Cybersecurity](<https://devfeed.tech/sources/rapid7-cybersecurity-blog.md>)

Topics: [static-site-generator](<https://devfeed.tech/topics/static-site-generator.md>), [SQL](<https://devfeed.tech/topics/sql.md>), [sql-server](<https://devfeed.tech/topics/sql-server.md>)

Tags: [cybersecurity-company](<https://devfeed.tech/tags/cybersecurity-company.md>), [database](<https://devfeed.tech/tags/database.md>), [exposure-assessment-platform](<https://devfeed.tech/tags/exposure-assessment-platform.md>), [exposure-management](<https://devfeed.tech/tags/exposure-management.md>), [managed-detection-and-response](<https://devfeed.tech/tags/managed-detection-and-response.md>), [managed-security-solutions](<https://devfeed.tech/tags/managed-security-solutions.md>), [microsoft-sql](<https://devfeed.tech/tags/microsoft-sql.md>), [rapid7-disclosure](<https://devfeed.tech/tags/rapid7-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [sql-injection](<https://devfeed.tech/tags/sql-injection.md>), [vector-command](<https://devfeed.tech/tags/vector-command.md>), [vulnerabilities-and-exploits](<https://devfeed.tech/tags/vulnerabilities-and-exploits.md>), [vulnerability-disclosure](<https://devfeed.tech/tags/vulnerability-disclosure.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

## AI overview

Rapid7 reports an unauthenticated SQL injection vulnerability in Channel Software WebAlliance eCommerce. The flaw allows attackers to access sensitive database information, and under certain database privilege and server conditions, run commands on the database server. The article describes the vulnerable SOAP parameter, exploitation details, and disclosure timeline.

## Source excerpt

Overview While performing continuous red teaming exercises through Rapid7's Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server. The vulnerability, scored as CVSSv3.1 9.8 (Critical). Product Description WebAlliance eCommerce by Channel Software is an all-in-one B2B e-commerce, digital catalog, and customer portal platform purpose-built for wholesale distributors and industrial manufacturers. Impact The SQL Injection exploit can be leveraged to view sensitive information in the database, such as user PII and passwords. If logged in with DB admin privileges, the vulnerability can be exploited to run system commands on the server running the database. Credit This vulnerability was discovered by Marcus Chang, Security Consultant at Rapid7 and is being disclosed in accordance with Rapid7's vulnerability disclosure policy. CVE-2026-108065 - Unauthenticated SQL InjectionTechnical Details Rapid7 exploited the vulnerability during blackbox testing and was unable to perform root cause analysis.The sUserID parameter in the GetUser method in a SOAP request to /preapproval.asmx doesn't properly escape the user supplied sUserID. The SQL query can be escaped by inserting a single quote in the parameter. The database is running Microsoft SQL Server which allows for stacked queries. The query can be escaped with ( '; ) to inject completely new SQL commands. POST /preapproval.asmx HTTP/2 Host: {target_site} User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Soapaction: http://tempuri.org/GetUser Content-Type: text/xml;charset=UTF-8 Content-Length: 377 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/enve