An out-of-band SQL injection vulnerability exists in the EDD application, allowing an attacker to inject malicious SQL through the Id_usuario parameter on /evaluacion_acciones_evalua.aspx. Because the data is transmitted via an external channel rather than returned directly, a successful exploit could extract any sensitive database information, compromising confidentiality. The flaw is identified as CWE‑89.

The vulnerability affects the Quatuor Evaluación de Desempeño (EDD) application. No specific version numbers are listed; the issue was present until the release on 12 November 2025.

With a CVSS base score of 9.3 the flaw is considered critical. The EPSS score is below 1 %, indicating a low probability of exploitation in the near term, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is likely remote, with an attacker manipulating a web request to execute the injection and exfiltrate data through an external channel.