Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WebAlliance eCommerce lets attackers run SQL commands

CVE-2026-108065 · published 1 day ago
Summary

The WebAlliance eCommerce system’s web service endpoint lets anyone send a specially‑crafted request that tricks the database into running their own commands. This can expose or change sensitive data and even give control over the server that stores the information. Apply the vendor’s latest security update or block access to the affected web service until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
channel software weballiance ecommerce <= 1.*
Original advisory text
Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-108065 · NVD
CVE-2026-108065 · MITRE
Track software like this
Free during beta