The vulnerability is an out‑of‑band SQL injection that can be triggered through the 'Id_usuario' parameter of the '/evaluacion_competencias_evalua.aspx' page. An attacker can send specially crafted input that causes the underlying database query to forward results to an external channel. The data is never returned to the web application, but the attacker can retrieve sensitive database contents via the OOB channel, resulting in a confidentiality breach. This weakness is a classic instance of CWE‑89 SQL injection.

The affected product is Quatuor's Performance Evaluation (EDD) application, developed by Gabinete Técnico de Programación. All versions released before the November 12, 2025 update are vulnerable. The fix was incorporated in the latest public release on that date.

The CVSS score of 9.3 reflects a high‑severity vulnerability that could allow attackers to exfiltrate data with little effort. The EPSS score of less than 1 % indicates that, at the time of this analysis, the probability of exploitation is low, and the vulnerability is not present in the CISA KEV list. Attackers would need to target the specific web endpoint, craft outbound queries, and monitor a controlled external endpoint to receive the data. The impact is limited to confidentiality; there is no documented privilege escalation or remote code execution.