An out-of-band SQL injection flaw in the ‘Id_usuario’ and ‘Id_evaluacion’ parameters of /evaluacion_inicio.aspx allows attackers to extract sensitive data from the database through an external channel, thereby compromising confidentiality. The flaw is a classic CWE-89 condition where untrusted input is passed to a database query without proper sanitization, and the use of out-of-band communication prevents the data from being returned directly to the user.

The vulnerability affects the Quatuor Evaluación de Desempeño (EDD) application produced by Gabinete Técnico de Programación. No specific release identifiers are listed, but the issue is fixed in the version released on November 12 2025. Therefore any earlier or unpatched instances are potentially vulnerable.

The CVSS base score of 9.3 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the flaw is not currently part of the CISA KEV catalog. Nonetheless, the attack vector is likely remote, via an HTTP request to the affected page, and requires the attacker to craft payloads that trigger an external query. The impact is a blind, out-of-band extraction of confidential data. The likelihood of exploitation is inferred to be low but not negligible as the vulnerability remains publicly known.