An out‑of‑band SQL injection vulnerability exists in the Performance Evaluation (EDD) application built by Gabinete Técnico de Programación. The flaw is triggered by the parameters 'Id_usuario' and 'Id_evaluacion' in the URL '/evaluacion_competencias_evalua_old.aspx'. An attacker can inject malicious SQL that is executed by the database and relayed through an external channel, providing the attacker with the contents of sensitive tables without the application returning the data directly. This attack compromises the confidentiality of stored information and can expose the full contents of the underlying database if the malicious payload succeeds.

The affected system is Quatuor:Evaluación de Desempeño (EDD). No specific version information is provided in the data, so the impact applies to all installations until patched.

The vulnerability has a CVSS score of 9.3, indicating high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment, and it is not listed in the CISA KEV catalog. Attackers would need network access that allows the OOB payload to reach an external channel, and the vulnerability enables sensitive data extraction without the application returning it directly. The only mitigation is a patch, released on November 12, 2025, which eliminates the vulnerability.