# CVE-2026-108065: Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce

> The sUserID parameter of the GetUser method in the /preapproval.asmx SOAP web service of Channel Software WebAlliance eCommerce is not sanitized, allowing unauthenticated SQL injection (CWE-89) with stacked queries against Microsoft SQL Server. Rapid7 published a PoC; the vendor did not respond and no fixed version is reported.

- **Published:** 2026-10-14T14:01:14Z
- **Last reviewed:** 2026-10-14T14:01:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3510
- **ID:** TL-2026-3510
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-108065

## Description

Channel Software WebAlliance eCommerce is a B2B e-commerce and digital catalog platform used by distributors and manufacturers. Rapid7 security consultant Marcus Chang discovered the flaw on 2026-07-13 during a red team engagement (via Rapid7's Vector Command service) and disclosed it publicly on 2026-10-14 after the vendor failed to respond to contact attempts between 2026-08-28 and 2026-10-09.

The vulnerable component is the SOAP endpoint /preapproval.asmx. In the GetUser method, the sUserID parameter does not properly escape user-supplied input (the PoC curl example also references sCustID). An unauthenticated attacker closes the string literal with a single quote and, because the backend is Microsoft SQL Server, can append stacked queries using the pattern 90'; { MSSQL statement } ;-- inside the <tem:sUserID> element of a SOAP request.

Rapid7 demonstrates blind, time-based detection by issuing IF IS_SRVROLEMEMBER('sysadmin') = 1 WAITFOR DELAY '00:00:02';-- to test whether the application's database login holds the sysadmin role. Impact described in the disclosure: reading sensitive database content (PII, passwords); execution of system commands if the database user has administrative privileges; and upload of ASPX files via SQL Ole Automation if the database is collocated with the web server, which yields code execution as a web shell.

CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected versions are not specified in the disclosure and no fixed version has been reported. No in-the-wild exploitation and no network IOCs (IPs, domains, hashes) were reported. Rapid7's published mitigation is to block access to /preapproval.asmx. No BeaconBeagle lookup was applicable because no network IOCs exist.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation

## Sources

- [Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce (Rapid7)](https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce)
- [NVD - CVE-2026-108065](https://nvd.nist.gov/vuln/detail/CVE-2026-108065)
- [CVSS v3.1 Calculator (FIRST)](https://www.first.org/cvss/calculator/3.1)
- [CWE-89: Improper Neutralization of Special Elements used in an SQL Command](https://cwe.mitre.org/data/definitions/89.html)
- [MITRE ATT&CK T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)
- [Ole Automation Procedures server configuration option (Microsoft)](https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/ole-automation-procedures-server-configuration-option)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3510