As cited
Copy frozen at (site build).
vulnerabilities
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Rapid7 discovered CVE-2026-108065, an unauthenticated SQL injection vulnerability in Channel Software WebAlliance eCommerce scored as critical (CVSS 9.8). The flaw exists in the GetUser method's sUserID parameter, which fails to properly escape user input in SOAP requests to /preapproval.asmx, allowing attackers to extract database contents or execute system commands if the database user holds administrative privileges. Channel Software did not respond to disclosure attempts, and the vulnerability was publicly disclosed on October 14, 2026.
Why it matters: Organizations running WebAlliance eCommerce are immediately at risk of database compromise and potential remote code execution without authentication; administrators should block access to /preapproval.asmx and contact Channel Software for patches.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Rapid7 discovered CVE-2026-108065, an unauthenticated SQL injection vulnerability in Channel Software WebAlliance eCommerce, scored as critical with a CVSS score of 9.8. The flaw in the GetUser SOAP method allows attackers to read database contents including user credentials and personally identifiable information, or execute system commands if the database has administrative privileges. Channel Software did not respond to disclosure attempts over three months before public disclosure on October 14, 2026.
Why it matters: Wholesale distributors and industrial manufacturers using WebAlliance eCommerce face immediate risk of database compromise, credential theft, and server takeover through unauthenticated network requests; patching or blocking /preapproval.asmx is urgent.
- Source published
- First seen by Cybersecurity Tracker