# Unauthenticated SQL injection via raw concatenation

Request params or headers reaching raw SQL before auth; legacy SOAP/ISAPI endpoints; quote-triggered DB errors

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2026-10-14. Updated 2026-10-23._

## How it works
Code takes a value from an unauthenticated request (query/body parameter, SOAP argument, or HTTP header) and builds a SQL string by concatenation, so the value is parsed as SQL syntax rather than data. The broken assumption is that the endpoint is protected by authentication or by "internal" placement, or that the input is already validated upstream. In practice the request reaches the query compiler before any auth check, and a quote or statement separator changes the query's meaning.

## Where it shows up
- Legacy endpoints alongside modern ones: `.asmx` SOAP methods, ISAPI DLLs, WSDL-exposed services, especially on non-standard ports or regional domains [E2](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce.md)[E3](https://bugbountylibrary.com/r/h1%3A592400.md).
- Data-access methods like `GetUser`/`GetCustomer` taking an ID or name argument straight into a query [E2](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce.md).
- Handlers that act on specific headers or `action=` values before session/auth logic runs [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-moveit-transfer-critical-vulnerability-rapid-response.md).
- Raw DB error text returned in SOAP/HTTP responses.
- Stacked-statement or time-based behavior differences on the same parameter.

## How to review
Trace every request-controlled value to the SQL call and confirm the invariant: the value is bound as a parameter (or strictly allow-listed) and the query is only reachable after an authorization decision. Check that auth is enforced at the handler, not assumed from the caller. For SOAP, enumerate each operation and confirm each one authenticates and parameterizes. Treat any string-built query with an interpolated variable as unsafe regardless of upstream validation. Confirm errors are not echoed to clients.

## Variants seen
- Unauthenticated SQLi in a legacy ISAPI DLL reached through the web frontend, chained with session/CSRF setup to pivot into file writes and a webshell [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-moveit-transfer-critical-vulnerability-rapid-response.md).
- SOAP `sUserID` concatenated into MSSQL, allowing stacked statements and sysadmin-level OS command execution [E2](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce.md).
- Browsable WSDL exposing unauthenticated functions, one with blind SQLi leading to `xp_cmdshell` [E3](https://bugbountylibrary.com/r/h1%3A592400.md).

## Impact and severity
Critical: unauthenticated read of PII and credentials, and in two cases OS command execution / RCE on production, one exploited at scale for ransomware [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-moveit-transfer-critical-vulnerability-rapid-response.md)[E2](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce.md)[E3](https://bugbountylibrary.com/r/h1%3A592400.md). Severity rises when the DB account is privileged (sysadmin), when stacked queries are allowed, and when the injection can be bridged into file writes or shell execution.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-moveit-transfer-critical-vulnerability-rapid-response.md
- E2: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce.md
- E3: https://bugbountylibrary.com/r/h1%3A592400.md