← CVE Intelligence

CVE-2026-108065

Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce PUBLISHED

Description (CNA)

SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.

Affected (CNA)

Vendor / productVersions
Channel Software / WebAlliance eCommerceaffected 0 through 1.*

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.