Channel Software WebAlliance eCommerce contains an unauthenticated SQL Injection flaw in the SOAP GetUser method of the /preapproval.asmx endpoint. An attacker can supply a crafted sUserID parameter that includes a single quote and stacked SQL statements, allowing the attacker to read data, write data, and potentially execute commands against the backend Microsoft SQL Server. This vulnerability directly exposes the integrity and confidentiality of the database and permits full exploitation of the database layer.

The affected product is Channel Software WebAlliance eCommerce. The description does not specify a particular version, so all released releases that have not received a vendor patch remain vulnerable.

The CVSS score of 9.8 classifies this vulnerability as critical. The EPSS score provides a very low exploitation probability (less than 1%). It is not listed in the CISA KEV catalog, indicating no confirmed exploitation at the time of analysis. The likely attack vector is an unauthenticated remote attacker sending a specially crafted SOAP request to the publicly exposed /preapproval.asmx endpoint. This requires only network access to that endpoint and no additional authentication, enabling the attacker to manipulate the backend database.