CVE-2026-108065

Channel Software WebAlliance eCommerce has a critical unauthenticated SQL injection in the SOAP GetUser method of the /preapproval.asmx endpoint. A remote attacker can send a crafted sUserID value containing a single quote and a stacked SQL query, which the application passes to the backend Microsoft SQL Server. Successful exploitation can let the attacker read and write database data and, depending on the SQL Server configuration, potentially execute commands on the database host. The affected version range is not stated in the published data. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat the /preapproval.asmx SOAP GetUser endpoint as untrusted until Channel Software publishes a fixed build, and apply that update as soon as it is available. Until then, restrict network access to the SOAP service, block or sanitize quote-bearing sUserID values at a WAF or reverse proxy, and review Microsoft SQL Server logs for unexpected queries or command execution from the WebAlliance account.