CVE-2025-41028: Epsilon RH SQL Injection Vulnerability

CVE-2025-41028 Overview

A critical SQL Injection vulnerability has been identified in Epsilon RH, a human resources management solution developed by Grupo Castilla. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete database contents by sending a specially crafted POST request using the sEstadoUsr parameter in the /epsilonnetws/WSAvisos.asmx web service endpoint.

Critical Impact

This vulnerability enables complete database compromise including unauthorized data extraction, modification, and deletion without authentication. Attackers can potentially access sensitive HR data, employee records, and other confidential information stored in the database.

Affected Products

• Epsilon RH by Grupo Castilla

Discovery Timeline

• 2025-10-20 - CVE-2025-41028 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-41028

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the Epsilon RH web services component. The vulnerable endpoint /epsilonnetws/WSAvisos.asmx fails to properly sanitize or parameterize user input received through the sEstadoUsr parameter in POST requests. This allows attackers to inject arbitrary SQL commands that are executed directly against the backend database.

The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous. An attacker can interact with the database remotely without any prior access or credentials, enabling complete database manipulation capabilities including data exfiltration, modification, and destruction.

Root Cause

The root cause of this vulnerability is improper input validation and failure to use parameterized queries or prepared statements when processing the sEstadoUsr parameter. User-supplied input is concatenated directly into SQL queries without sanitization, allowing malicious SQL syntax to be interpreted as part of the query structure rather than data.

Attack Vector

The attack vector is network-based, requiring the attacker to send a malicious POST request to the vulnerable web service endpoint. The exploitation process involves:

1. An attacker identifies the vulnerable endpoint at /epsilonnetws/WSAvisos.asmx
2. A POST request is crafted containing SQL injection payload in the sEstadoUsr parameter
3. The malicious SQL commands are executed against the database with the privileges of the application's database user
4. The attacker can then extract sensitive data, modify records, or delete database contents

The vulnerability does not require authentication, user interaction, or any special privileges, making it trivially exploitable by remote attackers.

Detection Methods for CVE-2025-41028

Indicators of Compromise

• Unusual or malformed POST requests to /epsilonnetws/WSAvisos.asmx containing SQL syntax
• Database query logs showing unexpected SQL commands or union-based queries
• Error messages in application logs indicating SQL syntax errors from the WSAvisos.asmx endpoint
• Unexpected database modifications or data exfiltration patterns

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in requests to the WSAvisos.asmx endpoint
• Monitor HTTP access logs for POST requests to /epsilonnetws/WSAvisos.asmx with suspicious payload patterns
• Enable and review database audit logging for anomalous query patterns
• Deploy intrusion detection systems (IDS) with SQL injection signature detection

Monitoring Recommendations

• Configure alerting for any requests containing common SQL injection keywords targeting the vulnerable endpoint
• Establish baseline traffic patterns for the Epsilon RH web services and alert on deviations
• Monitor database query execution times and volume for anomalies indicating data exfiltration
• Review authentication and authorization logs for evidence of privilege escalation attempts

How to Mitigate CVE-2025-41028

Immediate Actions Required

• Restrict network access to the /epsilonnetws/WSAvisos.asmx endpoint to trusted IP ranges only
• Implement a web application firewall (WAF) with SQL injection protection rules
• Contact Grupo Castilla for information on available security patches or updates
• Consider temporarily disabling the vulnerable web service if not critical to operations

Patch Information

Organizations should contact Grupo Castilla directly for official patch availability and update instructions. Monitor the INCIBE Security Notice for updates regarding remediation guidance.

Workarounds

• Deploy network-level access controls to limit access to the vulnerable endpoint
• Implement input validation at the network perimeter using WAF or reverse proxy rules
• Consider placing the Epsilon RH application behind a VPN to reduce exposure
• Enable database activity monitoring to detect and alert on potential exploitation attempts

# Example: Restrict access to vulnerable endpoint using iptables (adjust for your environment)
# Only allow connections from trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP