Loading vulnerability…
SQL Injection in Epsilon RH WSAvisos.asmx sEstadoUsr Parameter
CVE-2025-41028 is a critical SQL injection vulnerability in Epsilon RH by Grupo Castilla. The flaw affects the '/epsilonnetws/WSAvisos.asmx' endpoint, where the 'sEstadoUsr' POST parameter is not properly neutralized before being incorporated into SQL queries. A remote attacker can send crafted POST requests to this web service to manipulate backend database operations. According to the available advisory information, successful exploitation allows retrieval, creation, modification, and deletion of database records. No specific affected versions were listed in the provided content, but the vendor advisory indicates the issue is fixed in version 3.03.36.0121 and later.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to perform arbitrary database interactions through the vulnerable application logic, including reading, inserting, updating, and deleting records. In the context of an HR platform, this can result in exposure of sensitive personnel data, unauthorized modification of business records, destruction of data, and potential broader compromise of the application depending on database privileges and deployment architecture.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to '/epsilonnetws/WSAvisos.asmx' to only trusted sources, monitor for suspicious POST requests targeting that endpoint and especially the 'sEstadoUsr' parameter, and deploy WAF rules designed to detect and block SQL injection payloads. Temporary compensating controls should be treated only as interim measures until the fixed version is deployed.
Patch, then assume compromise.
Upgrade Epsilon RH to version 3.03.36.0121 or later, which contains the vendor fix. Additionally, ensure the vulnerable code path handling the 'sEstadoUsr' parameter uses parameterized queries or prepared statements, applies strict server-side input validation, and reviews database permissions to limit the impact of injection flaws.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.