CVE-2026-108065, an unauthenticated 9.8 SQL injection in WebAlliance eCommerce, is public with no patch after the vendor ignored Rapid7. Block /preapproval.asmx.
Rapid7 disclosed CVE-2026-108065 on 14 October 2026, an unauthenticated SQL injection in Channel Software's WebAlliance eCommerce. It is rated CVSS 9.8 (Critical). Rapid7 says the vendor never replied to its disclosure attempts, and its write-up mentions no patch. The only remediation it gives is to block access to /preapproval.asmx.
Who is affected
WebAlliance eCommerce is a B2B e-commerce, digital catalog and customer portal platform used by wholesale distributors and industrial manufacturers. Rapid7 does not state which versions are affected, so treat any deployment that exposes the endpoint as in scope until the vendor says otherwise.
Rapid7 contacted the vendor five times and got no reply.
The flaw
The GetUser SOAP method at /preapproval.asmx does not properly escape the sUserID parameter. No authentication is required (CVSS vector AV:N/AC:L/PR:N/UI:N). The backend is Microsoft SQL Server, which allows stacked queries. A single quote returns a syntax error, and time-based payloads let an attacker infer data, for example whether the database account is a sysadmin.
Rapid7 lists the impact as theft of sensitive data such as user PII and passwords. If the database account is highly privileged, an attacker can go further. A sysadmin can use OLE Automation to upload files, and if the database shares a server with the web application, uploaded ASPX files can run system commands.
Rapid7 found the issue by black-box testing, so the root cause is undetermined. Its write-up is also internally inconsistent. The main request uses GetUser and sUserID, while the curl proof of concept uses GetCustomer and sCustID. Check both when you test your own exposure.
Disclosure timeline
- 13 July 2026: Rapid7 discovers the flaw through its Vector Command continuous red teaming service and reports exploitation to a customer.
- 28 August: first contact with Channel Software.
- 8, 15 and 29 September: follow-ups.
- 9 October: final notice of the 14 October disclosure, with a request for a vendor statement.
- 14 October: public disclosure, with proof-of-concept requests in the post.
Rapid7 received no response at any point. With public proof-of-concept requests available and no patch, defenders should assume scanning will follow.
What to do
- Block
/preapproval.asmxat the web server, reverse proxy or WAF. Check first that nothing you rely on calls it. - Search web logs for requests to
/preapproval.asmx, especially SOAP calls with quote characters or SQL keywords insUserIDorsCustID, and for long, regular response delays that suggest time-based probing. - Check whether the application's database account is a sysadmin. Reduce its privileges, and keep the database off the web server if you can.
- Look for unexpected
.aspxfiles in the web root. - If you saw suspicious requests, rotate user credentials stored by the application.
- Ask Channel Software for a fix and affected-version information.