SQL Injection Vulnerability in Epsilon RH by Grupo Castilla
CVE-2025-41028

9.3CRITICAL

Key Information:

Vendor

Grupo Castilla

Status
Epsilon Rh
Vendor
CVE Published:
20 October 2025

What is CVE-2025-41028?

A SQL Injection vulnerability has been identified in Epsilon RH, allowing attackers to interact with the database by utilizing the ‘sEstadoUsr’ parameter in a POST request directed at the endpoint ‘/epsilonnetws/WSAvisos.asmx’. This flaw empowers malicious actors to execute unauthorized operations, including retrieving, creating, updating, and deleting database entries, thereby posing significant risks to data integrity and security.

Affected Version(s)

Epsilon RH 3.03.36.0121

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-in...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro GabaldĂłn JuliĂĄ
Javier Medina Munuera
Antonio José Gålvez Sånchez
Alejandro Baño Andrés
Álvaro Piñero Laorden
JSON
.
CVE-2025-41028 : SQL Injection Vulnerability in Epsilon RH by Grupo Castilla