WebAlliance eCommerce SOAP SQL Injection Vulnerability

Channel Software WebAlliance eCommerce is affected by an SQL Injection vulnerability (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint.

An unauthenticated remote attacker can exploit a crafted sUserID parameter value containing a single quote and stacked SQL query to read, write, and potentially execute commands on the backend Microsoft SQL Server.

• Affected version: [VERSION — missing]
• Attack vector: unauthenticated remote access to /preapproval.asmx
• Impact: read, write, and potential command execution on the backend Microsoft SQL Server