CVE-2026-1475: Performance Evaluation SQLi Vulnerability

CVE-2026-1475 Overview

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. This vulnerability exists in the Id_usuario parameter within the /evaluacion_acciones_evalua.aspx endpoint and allows attackers to extract sensitive information from the database through external channels without requiring the application to return data directly.

Critical Impact

Unauthenticated attackers can exploit this OOB SQL injection to exfiltrate sensitive database contents through DNS or HTTP channels, completely bypassing application-level data handling and compromising the confidentiality of stored information.

Affected Products

• Performance Evaluation (EDD) Application by Gabinete Técnico de Programación
• Quatuor Performance Evaluation system
• ASP.NET-based evaluation platforms using the vulnerable endpoint

Discovery Timeline

• 2026-01-27 - CVE-2026-1475 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1475

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The out-of-band (OOB) variant is particularly dangerous because it allows data exfiltration even when the application does not display database query results in its responses.

OOB SQL injection works by leveraging database-specific functions that can initiate external network connections. When traditional in-band SQL injection fails because the application doesn't return query results visibly, attackers can use OOB techniques to send data to an attacker-controlled server via DNS lookups, HTTP requests, or other network protocols supported by the database server.

The vulnerability resides in the Id_usuario parameter of the /evaluacion_acciones_evalua.aspx endpoint. When user-supplied input is not properly sanitized before being incorporated into SQL queries, malicious SQL code can be injected to execute arbitrary database commands.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the Performance Evaluation (EDD) application. The Id_usuario parameter value is directly concatenated into SQL statements without adequate sanitization, allowing attackers to inject malicious SQL syntax that the database server interprets as legitimate commands.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable /evaluacion_acciones_evalua.aspx endpoint with specially crafted payloads in the Id_usuario parameter.

The out-of-band technique leverages database-specific features to exfiltrate data. For Microsoft SQL Server environments (common with ASP.NET applications), attackers may utilize functions like xp_dirtree, xp_fileexist, or OPENROWSET to trigger DNS queries or HTTP connections that encode stolen data in the request. For other database systems, similar techniques exist using UTL_HTTP (Oracle), LOAD_FILE (MySQL), or COPY TO (PostgreSQL).

Since the data is transmitted out-of-band, traditional web application monitoring may not detect the exfiltration, as the malicious traffic originates from the database server rather than through the web application response. See the INCIBE Security Notice for additional technical details.

Detection Methods for CVE-2026-1475

Indicators of Compromise

• Unusual outbound DNS queries from database servers containing encoded data or suspicious subdomain patterns
• HTTP/HTTPS connections originating from database servers to unknown external endpoints
• SQL error logs showing malformed queries containing SQL injection payloads in the Id_usuario parameter
• Anomalous access patterns to /evaluacion_acciones_evalua.aspx with encoded or lengthy parameter values

Detection Strategies

• Deploy web application firewalls (WAF) with SQL injection detection rules targeting the vulnerable endpoint
• Implement database activity monitoring to detect execution of dangerous functions like xp_dirtree, xp_fileexist, OPENROWSET, or similar OOB techniques
• Monitor outbound network traffic from database servers for unexpected DNS or HTTP connections
• Configure intrusion detection systems (IDS) with signatures for common OOB SQL injection payloads

Monitoring Recommendations

• Enable detailed logging for the /evaluacion_acciones_evalua.aspx endpoint and review for suspicious Id_usuario values
• Implement network segmentation to restrict database server outbound connectivity and alert on bypass attempts
• Set up SIEM rules to correlate web application access logs with database server network activity

How to Mitigate CVE-2026-1475

Immediate Actions Required

• Restrict or disable access to the /evaluacion_acciones_evalua.aspx endpoint until a patch is applied
• Implement input validation on the Id_usuario parameter to accept only expected numeric or alphanumeric values
• Deploy WAF rules to block SQL injection attempts targeting the vulnerable endpoint
• Block outbound network connectivity from database servers to untrusted destinations

Patch Information

Consult the vendor Gabinete Técnico de Programación for official security patches. Review the INCIBE Security Notice for additional remediation guidance and updates on available fixes.

Workarounds

• Implement parameterized queries or prepared statements in the application code handling the Id_usuario parameter
• Apply input validation using allowlists to restrict acceptable characters and formats
• Disable or restrict dangerous database functions that enable OOB data exfiltration (e.g., xp_cmdshell, xp_dirtree on SQL Server)
• Configure network-level controls to prevent database servers from initiating outbound connections

# Example: Disable xp_cmdshell on Microsoft SQL Server
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;