Rapid7 has gone public with a critical flaw in WebAlliance eCommerce, a business-to-business storefront and customer portal from Channel Software, after three months of trying and failing to get a response from the vendor. The bug, CVE-2026-108065, lets anyone on the internet send database commands to the platform without logging in, and Rapid7 rates it CVSS 9.8. No patch has been announced.
WebAlliance is built for wholesale distributors and industrial manufacturers, combining an online catalog, ordering and a customer portal in one product. That means the database behind it can hold customer records and account credentials for the distributor's trading partners.
One unescaped field opens the database
The flaw is a SQL injection, a classic bug in which text typed into a web request is pasted straight into a database query, letting an attacker rewrite the query. According to Rapid7's disclosure, the sUserID parameter of the GetUser method in SOAP requests to the /preapproval.asmx endpoint is not properly escaped. The back end runs Microsoft SQL Server, which accepts stacked queries, so an attacker can close the original query and append entirely new SQL commands.
Rapid7 says the injection can be used to read sensitive data such as user personal information and passwords. If the application's database account has sysadmin rights, the attacker can go further: Rapid7 describes using SQL Server's OLE Automation feature to write files, and, where the database sits on the same server as the web application, dropping ASPX pages that run system commands when browsed. Its post includes a working proof-of-concept request.
The bug was found by Marcus Chang, a security consultant at Rapid7, during continuous red-team testing for a customer through the company's Vector Command service. Rapid7 notes it found and exploited the issue during black-box testing and could not perform root cause analysis, and the advisory does not list affected versions. Rapid7 does not report any exploitation in the wild.
A disclosure with no answer
Rapid7's timeline shows the issue was discovered on July 13, 2026, with first contact to Channel Software on August 28. Follow-ups went out on September 8, 15 and 29, and on October 9 Rapid7 warned the vendor of the October 14 publication date and asked for a statement. Rapid7 says it received no response at any point. With a public proof of concept and no fix, operators of exposed WebAlliance sites should treat this as urgent; for more on what attackers do once a SQL injection lands, see this earlier case of a server hijacked through one.
Block /preapproval.asmx until Channel Software ships a fix
Rapid7's only published remediation is to block access to /preapproval.asmx. Beyond that, organizations running WebAlliance should check that the application's database login does not hold sysadmin rights, which is what turns data theft into command execution, and review web and database logs for unusual SOAP requests to that endpoint. Customers should also press Channel Software directly for a patch timeline, since the vendor has not said one exists.
Disclosures like this one are a reminder that silence from a vendor does not make a bug go away; it only shifts the job of defending against it onto the customers.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.