CVE-2026-1472: Performance Evaluation SQLi Vulnerability

CVE-2026-1472 Overview

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter txAny in /evaluacion_competencias_autoeval_list.aspx, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

Critical Impact

This OOB SQL injection vulnerability allows unauthenticated remote attackers to extract sensitive database information through external channels, potentially exposing confidential employee performance evaluation data and other stored information without detection through normal application responses.

Affected Products

• Performance Evaluation (EDD) Application by Gabinete Técnico de Programación
• Quatuor Performance Evaluation System

Discovery Timeline

• 2026-01-27 - CVE-2026-1472 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1472

Vulnerability Analysis

This vulnerability is classified as CWE-89: SQL Injection, specifically an out-of-band (OOB) variant. Unlike traditional SQL injection where data is returned directly in application responses, OOB SQL injection leverages external channels to exfiltrate data. The vulnerable endpoint /evaluacion_competencias_autoeval_list.aspx accepts user input through the txAny parameter without proper sanitization or parameterized queries.

In OOB SQL injection attacks, the attacker crafts malicious SQL queries that cause the database server to make external network requests (such as DNS lookups or HTTP requests) containing the extracted data. This technique is particularly dangerous because it can bypass traditional security controls and leaves minimal traces in application logs since the data never passes through the web application layer.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the txAny parameter handling within the /evaluacion_competencias_autoeval_list.aspx endpoint. The application directly incorporates user-supplied input into SQL queries without proper sanitization, allowing attackers to inject arbitrary SQL commands. The OOB nature suggests the underlying database server has network access capabilities that can be exploited to exfiltrate data through DNS or HTTP channels.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can send specially crafted HTTP requests to the /evaluacion_competencias_autoeval_list.aspx endpoint with malicious SQL payloads in the txAny parameter. The vulnerability exploits the database server's ability to make outbound network connections, allowing data to be transmitted to attacker-controlled infrastructure.

The attack typically involves injecting SQL commands that utilize database-specific functions for network communication (such as xp_dirtree or xp_fileexist in SQL Server, or UTL_HTTP in Oracle) to send query results to an external server. This allows attackers to bypass web application firewalls that only inspect inbound traffic and response content.

For detailed technical information about the vulnerability mechanism, refer to the INCIBE Security Notice.

Detection Methods for CVE-2026-1472

Indicators of Compromise

• Unusual outbound DNS requests from database servers, particularly containing encoded data or suspicious domain patterns
• Unexpected HTTP/HTTPS connections originating from database server infrastructure to external IP addresses
• SQL Server error logs showing execution of extended stored procedures like xp_dirtree, xp_fileexist, or similar network-capable functions
• Access logs showing requests to /evaluacion_competencias_autoeval_list.aspx with unusual or encoded txAny parameter values

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in the txAny parameter
• Deploy network monitoring to identify outbound connections from database servers to non-whitelisted destinations
• Enable database query logging and audit suspicious queries containing OOB-related functions or external resource references
• Configure SentinelOne Singularity to monitor for behavioral anomalies in database server processes making unexpected network connections

Monitoring Recommendations

• Monitor all HTTP requests to /evaluacion_competencias_autoeval_list.aspx for SQL injection patterns and anomalous parameter values
• Implement egress filtering on database servers and alert on any unexpected outbound network traffic
• Configure database activity monitoring to detect execution of potentially dangerous stored procedures or functions
• Enable real-time alerting for any DNS queries or HTTP requests originating from database server infrastructure

How to Mitigate CVE-2026-1472

Immediate Actions Required

• Restrict network access from database servers to prevent outbound connections to untrusted destinations
• Implement input validation and parameterized queries for the txAny parameter in /evaluacion_competencias_autoeval_list.aspx
• Deploy web application firewall rules specifically targeting SQL injection patterns
• Contact Gabinete Técnico de Programación for official patch availability and remediation guidance

Patch Information

Organizations using the affected Performance Evaluation (EDD) application should consult the vendor Gabinete Técnico de Programación for official security patches. Review the INCIBE Security Notice for additional remediation guidance and updates.

Workarounds

• Disable or restrict access to the vulnerable endpoint /evaluacion_competencias_autoeval_list.aspx until a patch is available
• Implement strict egress filtering on database servers to block all unnecessary outbound network traffic
• Deploy a web application firewall with SQL injection detection rules specifically targeting the txAny parameter
• Disable dangerous database stored procedures and functions that enable network communication (e.g., xp_dirtree, xp_fileexist, UTL_HTTP)

# Example: SQL Server - Disable dangerous extended stored procedures
# Run these commands to restrict OOB capabilities
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;

# Revoke execute permissions on network-capable procedures
REVOKE EXECUTE ON xp_dirtree TO public;
REVOKE EXECUTE ON xp_fileexist TO public;