An out‑of‑band SQL injection (OOB SQLi) flaw was found in the Quatuor Performance Evaluation (Evaluación de Desempeño) application, specifically in the 'Id_usuario' parameter of the /evaluacion_acciones_ver_auto.aspx endpoint. The vulnerability allows an attacker to inject arbitrary SQL that is executed silently on the database and the results are retrieved via external channels rather than displayed directly to the application user. This mechanism enables an attacker to exfiltrate sensitive data from the database, compromising the confidentiality of stored information.

The flaw affects the Quatuor Performance Evaluation (evaluación de desempeño) application. Affected versions are unspecified, but the issue remains present until the latest successful release dated 12 November 2025. Users operating versions prior to that release are susceptible.

The CVSS score of 9.3 classifies this as critical severity. While the EPSS indicates a very low probability of exploitation (<1%), the lack of a public exploit and absence from the CISA KEV catalogue reduce the immediacy of threat. Exploitation requires sending a specially crafted value for 'Id_usuario' that triggers an external database response, so attackers need network access to the application and the ability to observe or capture outbound traffic from the database server.