CVE-2026-1478: Performance Evaluation (EDD) SQLi Vulnerability

CVE-2026-1478 Overview

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. This vulnerability affects the Id_usuario and Id_evaluacion parameters in the /evaluacion_hca_evalua.aspx endpoint, allowing attackers to extract sensitive information from the database through external channels without the affected application returning the data directly.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely to exfiltrate sensitive database information through out-of-band channels, compromising the confidentiality of stored data without triggering standard application-level detection mechanisms.

Affected Products

• Performance Evaluation (EDD) Application by Gabinete Técnico de Programación
• Quatuor Performance Evaluation System

Discovery Timeline

• 2026-01-27 - CVE-2026-1478 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1478

Vulnerability Analysis

This out-of-band SQL injection vulnerability (CWE-89) resides in the Performance Evaluation application's evaluation handling functionality. Unlike traditional SQL injection attacks that rely on the application returning query results directly, OOB SQLi leverages external communication channels to exfiltrate data.

The vulnerability is triggered when user-controlled input in the Id_usuario and Id_evaluacion parameters is processed by the /evaluacion_hca_evalua.aspx endpoint without proper sanitization. An attacker can craft malicious SQL queries that instruct the database server to establish outbound connections to attacker-controlled infrastructure, transmitting sensitive data through DNS lookups, HTTP requests, or other network protocols.

This type of attack is particularly dangerous because it bypasses traditional web application firewalls and intrusion detection systems that monitor for inline SQL error messages or anomalous response data. The attack exploits the database server's ability to make network connections, effectively creating a covert data exfiltration channel.

Root Cause

The root cause of this vulnerability is insufficient input validation and the lack of parameterized queries when processing the Id_usuario and Id_evaluacion parameters. The application directly concatenates user-supplied input into SQL statements, allowing attackers to inject arbitrary SQL code. Combined with database features that support network operations (such as xp_dirtree in Microsoft SQL Server or UTL_HTTP in Oracle), attackers can establish out-of-band communication channels for data exfiltration.

Attack Vector

The attack is network-based and can be executed by unauthenticated remote attackers. The exploitation process involves:

1. Parameter Identification: Attacker identifies the vulnerable parameters (Id_usuario and Id_evaluacion) in the /evaluacion_hca_evalua.aspx endpoint
2. Payload Injection: Malicious SQL is injected that triggers outbound network requests containing database content
3. Data Exfiltration: The attacker's server receives DNS queries or HTTP requests containing encoded database information
4. Data Reconstruction: Exfiltrated data fragments are assembled to reveal sensitive information

The attack requires no user interaction and can be automated to systematically extract entire database contents without generating suspicious application responses. For detailed technical information, refer to the INCIBE Security Notice.

Detection Methods for CVE-2026-1478

Indicators of Compromise

• Unusual outbound DNS queries from database servers containing encoded data patterns or suspicious subdomain structures
• Unexpected HTTP/HTTPS connections originating from database server processes to external IP addresses
• Abnormal query execution times in /evaluacion_hca_evalua.aspx requests, indicating time-based SQL injection probing
• Web server logs showing malformed or unusually long values in Id_usuario or Id_evaluacion parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the Id_usuario and Id_evaluacion parameters
• Monitor database server network activity for outbound connections, particularly DNS lookups to suspicious or unfamiliar domains
• Deploy SQL query logging and analyze for anomalous query structures, especially those containing network-related SQL functions
• Use SentinelOne Singularity™ Platform to detect and respond to suspicious database process behaviors and network anomalies

Monitoring Recommendations

• Enable detailed logging for all requests to /evaluacion_hca_evalua.aspx and correlate with database query logs
• Configure network monitoring to alert on database server egress traffic to non-whitelisted destinations
• Implement real-time alerting for SQL injection signature matches in input validation layers
• Monitor for database-specific OOB functions such as xp_dirtree, xp_fileexist, UTL_HTTP, or LOAD_FILE() in query logs

How to Mitigate CVE-2026-1478

Immediate Actions Required

• Immediately restrict network access from the application server to external networks where possible
• Implement input validation to reject non-numeric or suspicious values in Id_usuario and Id_evaluacion parameters
• Deploy a Web Application Firewall (WAF) with SQL injection detection rules enabled for the vulnerable endpoint
• Review and restrict database user privileges to limit access to network-related stored procedures and functions

Patch Information

Consult the vendor Gabinete Técnico de Programación for official security patches addressing this vulnerability. Review the INCIBE Security Notice for the latest remediation guidance and updates.

Workarounds

• Implement parameterized queries or prepared statements to prevent SQL injection at the application layer
• Apply strict input validation allowing only expected data types (numeric IDs) for the vulnerable parameters
• Disable or restrict database features that enable outbound network connections (e.g., xp_cmdshell, OLE Automation, xp_dirtree in SQL Server)
• Segment the database server network to prevent direct outbound internet access

# Example: Block outbound DNS from database server (Linux iptables)
iptables -A OUTPUT -p udp --dport 53 -m owner --uid-owner mssql -j DROP
iptables -A OUTPUT -p tcp --dport 53 -m owner --uid-owner mssql -j DROP

# Example: Disable dangerous SQL Server features
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
EXEC sp_configure 'Ole Automation Procedures', 0;
RECONFIGURE;