CVE-2026-108065

Summary

A SQL Injection vulnerability in Channel Software WebAlliance eCommerce's SOAP service allows remote attackers to execute arbitrary SQL commands on the backend database without authentication. This critical flaw enables attackers to read, write, and potentially execute commands on the SQL Server backend.

Exploitability

Exploitation is straightforward requiring only a single quote character and stacked SQL query in the sUserID parameter, with no authentication or user interaction required.

Blast radius

The vulnerability could lead to complete database compromise with potential data exfiltration, unauthorized modifications, and possible command execution on the backend SQL Server system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published in the description; disable access to the /preapproval.asmx endpoint until a patch is available or implement network-level restrictions to limit access to this SOAP service.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.