Weballiance Ecommerce
Monthly
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.