Channel WebAlliance eCommerce suffers critical unauthenticated SQL injection
Rapid7 found that a SOAP endpoint in Channel Software WebAlliance allows attackers to execute SQL commands on backend servers without credentials.
Key points
- CVE-2026-108065 is rated CVSS 9.8 Critical due to unauthenticated remote access.
- Attackers can extract PII or run system commands if the database has high privileges.
- No vendor patch or official statement has been confirmed following public disclosure.
Rapid7 disclosed CVE-2026-108065 on October 14, 2026, revealing a critical SQL injection flaw in Channel Software WebAlliance eCommerce. The vulnerability exists in the /preapproval.asmx endpoint, where the sUserID parameter in the GetUser SOAP method fails to escape user input. This allows unauthenticated remote attackers to inject single quotes and execute stacked SQL queries against the backend Microsoft SQL Server, according to Rapid7’s technical analysis.
The risk
The flaw enables attackers to read sensitive data, including personally identifiable information and passwords, stored in the database. If the database user account holds sysadmin privileges, the attacker can escalate the breach to run system commands on the server hosting the database. Rapid7 noted that if the database and web application share the same server, attackers could upload ASPX files to execute arbitrary code, effectively compromising the entire host system.
Who is exposed
Channel Software WebAlliance eCommerce versions up to 1.* are affected by this vulnerability. The platform is designed for wholesale distributors and industrial manufacturers, serving as a B2B e-commerce and digital catalog solution. Any organization running these older versions with the /preapproval.asmx endpoint exposed to the internet is potentially at risk. Rapid7 discovered the issue during black-box red teaming exercises via its Vector Command service.
Cost and compliance
Exposure of user PII and passwords through this SQL injection could trigger regulatory reporting requirements under data protection laws. The potential for remote code execution on backend servers increases the operational cost of incident response and forensic investigation. Organizations must assess whether their current database configurations allow high-privilege access from the web tier, as this significantly amplifies the blast radius of the compromise.
What to watch
Security teams should monitor for unusual traffic patterns targeting the /preapproval.asmx endpoint, particularly requests containing single quotes or unusual SOAP structures. Watch for database performance anomalies, such as unexpected delays or high CPU usage, which may indicate time-based SQL injection attempts. Additionally, review web server logs for HTTP responses returning SQL syntax errors, which may signal injection attempts.
Signals worth monitoring
Teams usually detect this activity by analyzing web application logs for malformed SOAP requests or syntax error responses from the database layer. Check whether database audit logs show unexpected query executions or privilege escalation attempts by the application service account. Monitor for outbound connections from the database server to external IP addresses, which may indicate data exfiltration. First containment moves involve blocking traffic to the vulnerable endpoint at the firewall or WAF level and restricting the database account’s permissions to prevent command execution.
What to do and how to stay safe: Channel Software
- Audit your WebAlliance eCommerce version and verify if it falls within the affected up-to-1.* range.
- Restrict network access to the /preapproval.asmx endpoint, allowing only trusted internal IPs if remote access is not required.
- Review database user permissions to ensure the application account does not have sysadmin or high-privilege roles.
- Implement web application firewalls to block requests containing single quotes or stacked SQL commands targeting SOAP endpoints.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch available for CVE-2026-108065?
No, Rapid7 reported no response from Channel Software regarding a fix or vendor statement before public disclosure.
Can this vulnerability be exploited without login credentials?
Yes, the SQL injection in the sUserID parameter is unauthenticated, allowing remote attackers to exploit it directly.
What data can attackers access through this flaw?
Attackers can read sensitive database contents, including user PII and passwords, and potentially execute system commands.
