Channel Software WebAlliance eCommerce: Unauthenticated SQL injection
Summary
WebAlliance eCommerce, a B2B e-commerce and customer portal platform, contains an SQL injection in the SOAP GetUser method of /preapproval.asmx (CVE-2026-108065, CVSS 9.8). An unauthenticated remote attacker can inject SQL through the sUserID parameter to read data such as user details and passwords, and can modify data. If the database account has high privileges, the attacker may also run system commands on the database server, for example by uploading ASPX files when the database runs on the web server.
Affected
- Channel Software WebAlliance eCommerce, SOAP endpoint /preapproval.asmx (GetUser method)
- The official CVE record lists the affected range as 0 to <= 1.*. The CVE description states the version as missing, so the range is unconfirmed.
Fixed in
Unknown. No vendor fix or advisory was found. Rapid7 reports that Channel Software did not respond to disclosure contact.
Workaround
- Block external access to /preapproval.asmx at the WAF, reverse proxy or IIS level if the endpoint is not required (Rapid7 remediation).
- Run the database account with least privilege so that command execution is not possible.
- Review IIS and SQL Server logs for unusual requests to /preapproval.asmx. Errors may be returned inside HTTP 200 SOAP responses.
Exploitation
- Public technical details and a proof-of-concept request were published by Rapid7 on 14 October 2026.
- The vulnerability is unauthenticated and network-reachable.
- No confirmed exploitation in the wild was found. The CISA KEV status could not be verified.
- The SSVC assessment lists exploitation as none and automatable as yes.
Our recommendation
- Check whether WebAlliance eCommerce is in use and whether /preapproval.asmx is reachable from the internet.
- Block /preapproval.asmx now if the endpoint is not needed, and treat any internet-facing instance without a fix as high priority.
- Restrict database privileges and monitor logs for injection attempts.
- Ask Channel Software for affected versions, a fix and a release date, and apply the fix as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rapid7 blog: Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce www.rapid7.com
- Vulners VulnRichment: CVE-2026-108065 vulners.com
- HackTricks write-up summary (GitHub PR) github.com
- Vendor product page: Channel Software www.channelsoftware.com
- ThreatInt: CVE-2026-108065 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:58.
Original description (NVD)
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.