CVE-2026-108065

Name of the Vulnerable Software and Affected Versions Channel Software WebAlliance eCommerce (affected versions not specified)

Description An unauthenticated remote attacker can perform a SQL Injection (CWE-89), which is a flaw where malicious SQL statements are inserted into entry fields for execution. This occurs via the SOAP GetUser method of the /preapproval.asmx endpoint using a crafted sUserID parameter containing a single quote and stacked SQL queries. This allows the attacker to read and write sensitive database contents, such as customer records, credentials, and orders, and potentially execute system commands on the backend Microsoft SQL Server depending on database user privileges.

Recommendations Apply the vendor patch. Deploy a WAF rule to block SQLi patterns targeting the application. Restrict database user privileges to the principle of least privilege. Audit logs for anomalous queries or outbound database connections.