{"id":"CVE-2026-108065","published":"2026-10-14T14:17:33.813","lastModified":"2026-10-16T19:56:15.773","description":"SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL Injection vulnerability in Channel Software WebAlliance eCommerce's SOAP service allows remote attackers to execute arbitrary SQL commands on the backend database without authentication. This critical flaw enables attackers to read, write, and potentially execute commands on the SQL Server backend.","exploitability":"Exploitation is straightforward requiring only a single quote character and stacked SQL query in the sUserID parameter, with no authentication or user interaction required.","blast_radius":"The vulnerability could lead to complete database compromise with potential data exfiltration, unauthorized modifications, and possible command execution on the backend SQL Server system.","remediation":"No fixed version is published in the description; disable access to the /preapproval.asmx endpoint until a patch is available or implement network-level restrictions to limit access to this SOAP service.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","soap","database"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:47:51.890Z"}}