CVE-2026-108065: Critical Pre-Auth SQL Injection in WebAlliance B2B E-Commerce Platform

On October 14, 2026, Rapid7 published a technical advisory for CVE-2026-108065, an unauthenticated SQL injection vulnerability rated CVSS 9.8 that affects the Channel Software WebAlliance eCommerce platform. The flaw resides in the sUserID parameter of the GetUser method exposed on the /preapproval.asmx SOAP endpoint: an escaping error allows manipulation of the underlying SQL query, with consequences ranging from sensitive data reads to system command execution when the database account holds sysadmin privileges. The discovery, made on July 13, 2026, during continuous red teaming exercises, highlights risks in a category of commercial B2B platforms.

The Mechanism: From a Missing Quote to Conditional Control

Rapid7's advisory describes the attack path precisely. The sUserID parameter in the GetUser method "does not properly escape user input": inserting a single quote breaks the legitimate query and allows concatenation of arbitrary statements. The server response includes error messages indicating the condition: "Incorrect syntax near 'ZZZ'. Unclosed quotation mark after the character string ''" — an example with a specific payload, not a generic proof of vulnerability.

The severity is amplified by two concurrent technical characteristics. First, the endpoint is reachable without authentication: the attacker needs no valid credentials. Second, the database is Microsoft SQL Server, which supports stacked queries — the chained execution of multiple SQL statements in a single call. This enables operations well beyond simple reads: schema enumeration, table access, and, in the presence of sysadmin privileges, activation of SQL Ole Automation to write files.

Rapid7 demonstrated this escalation concretely: the IS_SRVROLEMEMBER('sysadmin') function verifies the account's privileges, and SQL Ole Automation allows one to "load a file" — in this specific case, an ASPX web shell. The necessary condition for this second stage is twofold: the service account must hold the sysadmin role, and the database and web server must be co-located (or at least writable from the SQL Server process perspective). The source does not specify whether this co-location is typical for WebAlliance eCommerce deployments.

The Target Platform: B2B E-Commerce with a Specific Risk Profile

WebAlliance eCommerce is a product of Channel Software, a vendor specializing in platforms for wholesale distributors and industrial manufacturers. This typological profile — commercial software for vertical sectors — constitutes a category that, according to industry observers, can have longer patch cycles compared to consumer-oriented solutions.

The NVD record indicates affected versions with the notation 0 <=1.*: a syntax that theoretically covers all existing releases up to major version 1, yet without indicating which version resolves the flaw. Rapid7's advisory presents a timeline section with September 2026 truncated, making it impossible to establish with certainty whether Channel Software has released a patch in the meantime.

Timeline and Disclosure: The Gap Between Discovery and Publication

The documented chronology shows a methodical path. Marcus Chang's discovery dates to July 13, 2026, during continuous red teaming exercises conducted via Rapid7's Vector Command service. Initial contact with Channel Software occurred on August 28, 2026. The public advisory publication is dated October 14, 2026; the NVD record was already published as of September 23, 2026.

The interval between discovery and publication is 92 days; between vendor contact and publication, 47 days. The source does not specify internal disclosure policies or reasons for these timeframes.

Immediate Actions

Plausible defensive actions for organizations using WebAlliance eCommerce are limited to what can be inferred from the technical brief, with the following qualifications.

Verifying exposure of the /preapproval.asmx endpoint on public interfaces is the first documentable step. Restricting access to this endpoint, where architecturally feasible, would reduce the attack surface for an unauthenticated vector.

Verifying the database service account's privileges — specifically whether it holds the sysadmin role — is relevant for assessing the risk of escalation to system command execution. The source does not specify typical configurations or vendor recommendations on this point.

Monitoring for anomalous SOAP requests to /preapproval.asmx with sUserID parameters containing single quotes or concatenated SQL statements represents a plausible defensive approach, although the source does not detail specific patterns or alert thresholds.

Key Stat

CVSS 9.8 (Critical) — Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is network-accessible without authentication, with complete impact on confidentiality, integrity, and availability.

Analysis in Context

This case illustrates a recurring dynamic in the vertical commercial software security landscape: discovery via continuous red teaming reveals vulnerabilities in platforms that may not undergo systematic third-party security testing. Rapid7's Vector Command service, through which Marcus Chang conducted the activity, represents a model of proactive verification commissioned by the vendor itself — an approach that, as documented, led to identification and subsequent coordinated disclosure.

The lack of clarity on patch status — stemming from truncated text in the advisory — constitutes a significant information gap for defenders. Organizations using WebAlliance eCommerce cannot, based on available sources, determine with certainty whether an updated version exists to install.

Methodological Note. This analysis is based on a Rapid7 advisory and a convergent NVD record; no additional independent sources are available. Considerations on industry practices and market dynamics are presented as conditional observations, not as verified facts.

Information has been verified against cited sources and is current as of publication.

Sources

• https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce
• https://nvd.nist.gov/vuln/detail/CVE-2026-108065
• https://www.rapid7.com/platform/
• https://www.rapid7.com/products/command/attack-surface-management-asm/
• https://www.rapid7.com/products/command/exposure-management/