CVE-2026-1473: Performance Evaluation SQLi Vulnerability

CVE-2026-1473 Overview

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. This vulnerability exists in the Id_usuario parameter within the /evaluacion_competencias_evalua.aspx endpoint, allowing attackers to extract sensitive information from the database through external channels without the application returning data directly. The flaw compromises the confidentiality of stored information and poses a significant risk to organizations using this application.

Critical Impact

Unauthenticated attackers can exploit this OOB SQL injection to exfiltrate sensitive database contents through external DNS or HTTP channels, bypassing traditional detection mechanisms and compromising organizational data confidentiality.

Affected Products

• Performance Evaluation (EDD) Application by Gabinete Técnico de Programación
• Systems running the /evaluacion_competencias_evalua.aspx endpoint
• Database systems connected to the EDD application

Discovery Timeline

• 2026-01-27 - CVE-2026-1473 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1473

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The out-of-band variant exploited here is particularly insidious because it allows attackers to extract data through external channels such as DNS lookups or HTTP requests, rather than relying on in-band responses from the vulnerable application.

The attack targets the Id_usuario parameter in the /evaluacion_competencias_evalua.aspx endpoint. When user-supplied input is not properly sanitized before being incorporated into SQL queries, attackers can inject malicious SQL statements that cause the database server to initiate outbound connections to attacker-controlled infrastructure, carrying exfiltrated data in these requests.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the Id_usuario parameter before it is used in database queries. The application fails to properly escape or parameterize user input, allowing specially crafted SQL statements to be executed by the underlying database engine. This lack of prepared statements or parameterized queries enables the injection attack.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests to the /evaluacion_competencias_evalua.aspx endpoint with malicious SQL payloads in the Id_usuario parameter.

In an out-of-band SQL injection scenario, the attacker injects SQL commands that cause the database server to make external network requests (such as DNS lookups or HTTP calls) to attacker-controlled servers. The exfiltrated data is encoded within these requests, allowing the attacker to retrieve sensitive information even when the application does not display query results directly. Common techniques include using database-specific functions like xp_dirtree (SQL Server), UTL_HTTP (Oracle), or LOAD_FILE (MySQL) to establish outbound connections.

For detailed technical information, see the INCIBE Notice on SQL Injection.

Detection Methods for CVE-2026-1473

Indicators of Compromise

• Unusual outbound DNS queries from database servers containing encoded data patterns
• HTTP/HTTPS connections from database servers to external IP addresses or domains
• Anomalous network traffic patterns from systems hosting the EDD application
• Web server logs showing requests to /evaluacion_competencias_evalua.aspx with suspicious Id_usuario parameter values containing SQL syntax

Detection Strategies

• Deploy web application firewalls (WAF) with SQL injection detection rules targeting the Id_usuario parameter
• Monitor database query logs for unusual or unauthorized SQL commands, especially those invoking network functions
• Implement intrusion detection system (IDS) rules to identify SQL injection patterns in HTTP request parameters
• Configure network monitoring to alert on unexpected outbound connections from database server infrastructure

Monitoring Recommendations

• Enable detailed logging on the web server for all requests to /evaluacion_competencias_evalua.aspx
• Monitor DNS server logs for queries containing unusual or encoded strings originating from database servers
• Implement egress filtering and alerting for database servers to detect unauthorized outbound connections
• Review application logs for error messages that may indicate SQL syntax errors from injection attempts

How to Mitigate CVE-2026-1473

Immediate Actions Required

• Restrict network access to the /evaluacion_competencias_evalua.aspx endpoint to trusted IP addresses only
• Implement strict egress filtering on database servers to prevent unauthorized outbound connections
• Deploy or update WAF rules to block SQL injection attempts in the Id_usuario parameter
• Consider temporarily disabling the vulnerable endpoint until a patch is available

Patch Information

Organizations should monitor the INCIBE Security Notice for updates from Gabinete Técnico de Programación regarding official patches for the Performance Evaluation (EDD) application. Contact the vendor directly for patch availability and deployment guidance.

Workarounds

• Implement input validation at the application layer to reject SQL syntax characters in the Id_usuario parameter
• Use parameterized queries or prepared statements for all database interactions involving user input
• Apply network segmentation to isolate database servers and restrict their ability to make outbound connections
• Deploy additional monitoring and alerting for any access to the vulnerable endpoint

# Example WAF rule configuration to block SQL injection patterns
# Add to your WAF configuration file

# Block common SQL injection keywords in Id_usuario parameter
SecRule ARGS:Id_usuario "@rx (?i)(union|select|insert|update|delete|drop|exec|xp_)" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt blocked'"

# Block OOB-specific functions
SecRule ARGS:Id_usuario "@rx (?i)(xp_dirtree|utl_http|load_file|into\s+outfile)" \
    "id:100002,phase:2,deny,status:403,msg:'OOB SQL Injection attempt blocked'"