# Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

Unauthenticated SQL injection in the sUserID parameter of the GetUser SOAP method at /preapproval.asmx lets attackers read PII/passwords and, as sysadmin, run OS commands.

- Payout: Research
- Severity: critical
- Program: Channel Software WebAlliance
- Credited: Marcus Chang
- Disclosed: 2026-10-14
- CVE: CVE-2026-108065
- Write-up quality: 6/10
- Original: https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce
- Library page: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce
- Tags: domain:web impact:data-leak impact:pii-leak impact:rce kind:research platform:threat-intel sev:critical tech:rest technique:blind technique:source-review vuln:sqli

**Target:** SOAP endpoint /preapproval.asmx (GetUser sUserID parameter) on IIS/MSSQL
**Root cause:** The sUserID parameter in the GetUser SOAP method is concatenated into a SQL query without escaping, allowing quote breakout and stacked MSSQL statements.
**Steps:**
1. Send POST to `/preapproval.asmx` with `Soapaction: http://tempuri.org/GetUser` and XML body containing `<tem:sUserID>90'</tem:sUserID>`
2. Observe MSSQL syntax error in `GetCustomerResult` confirming injection
3. Inject `90';IF IS_SRVROLEMEMBER('sysadmin') = 1 WAITFOR DELAY '00:00:02';--` to confirm sysadmin via time delay
4. Use stacked queries / Ole Automation to write an ASPX file to webroot if DB and web app share server
5. Browse uploaded ASPX to execute system commands
**How found:** Discovered during blackbox red teaming via Rapid7 Vector Command; a single quote in sUserID produced a SQL syntax error in the SOAP response, confirming injection, then stacked/time-based payloads were used to test privileges.
**Exploitation:** Blackbox testing: attacker sends crafted SOAP request to unauthenticated /preapproval.asmx, breaks out of the sUserID string with a single quote, and appends stacked MSSQL statements. Time-based payloads confirm sysadmin; Ole Automation then writes an ASPX webshell to the webroot, which is browsed to run OS commands.
**Escalation:** SQLi to data exfiltration (PII/passwords); if DB user is sysadmin, escalate to OS command execution via Ole Automation ASPX upload when DB and web app co-hosted.
**Insight:** Legacy .asmx SOAP endpoints often expose internal data-access methods (GetUser/GetCustomer) that bypass newer input handling; probe every SOAPAction with a single quote and watch for raw DB errors in the XML response, then test stacked queries since MSSQL permits them.