Rapid7 finds a 9.8 SQL injection in Channel Software's WebAlliance commerce platform

Reading the user table and running commands on the host are two different levels of access, and only the first needs nothing more than the injection. Rapid7 says it confirmed the bug in blackbox testing and did not perform root cause analysis ^[10]. A single quote in the parameter makes SQL Server return a syntax error in the HTTP response, which confirms the input reaches the query ^[13]. From there extraction is blind: each query returns one answer through a measured delay rather than in the response body, and the sysadmin test sleeps the connection for two seconds when the condition holds ^[11].

Nothing in the request needs a session or a login, so the only barrier is reaching /preapproval.asmx ^[8]. For an internet-facing portal, that is a single SOAP POST.

The command path depends on database privileges. One of Rapid7's payloads only delays when the current account holds the sysadmin role, the same role the file-upload path needs ^[11][4]. Where the database account runs with lower rights, the exposure stops at reading data ^[4].

This is a disclosure, not an incident report. Rapid7 found the flaw in its own testing, and nothing in the write-up points to exploitation in the wild ^[5][10].

Rapid7 credits security consultant Marcus Chang and published the bug under its disclosure policy ^[14]. It included a working curl proof-of-concept alongside the write-up ^[16]. The disclosure lists no fixed version ^[15].