Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Rapid7 disclosed critical unauthenticated SQL injection CVE-2026-108065 in Channel Software WebAlliance eCommerce.
Rapid7 disclosed CVE-2026-108065, a critical unauthenticated SQL injection in Channel Software WebAlliance eCommerce, scored CVSS 9.8. The GetUser SOAP method fails to handle the sUserID parameter safely against Microsoft SQL Server, letting attackers read database data such as user PII and passwords. If the database account is highly privileged, the issue can also be used to run commands on the database server. Rapid7 found the flaw during Vector Command testing, received no vendor response, and published details on October 14, 2026, advising defenders to block the affected endpoint.
- CVE-2026-108065 is unauthenticated SQL injection scored CVSS 9.8.
- The flaw is in the GetUser SOAP method's sUserID parameter on Microsoft SQL Server.
- Attackers could read PII and passwords, or run commands if the database account is privileged.
- Channel Software did not respond; Rapid7 disclosed publicly on October 14, 2026.
- Rapid7 advises blocking access to the vulnerable preapproval endpoint.
- CVEs
- CVE-2026-108065
- Vendors
- Channel Software
- Products
- WebAlliance eCommerce
- Organizations
- Rapid7
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108065 | Unauthenticated SQL injection in WebAlliance eCommerce | 9.8 | — |
From the original article
3 min read at rapid7.comOverview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce. The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server.
By Marcus Chang · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.