An out-of-band SQL injection flaw exists in the Quatuor Evaluación de Desempeño application that allows a malicious actor to deliver payloads via the Id_usuario and Id_evaluacion parameters sent to /evaluacion_hca_ver_auto.asp. The injection is executed externally, enabling the attacker to retrieve sensitive database contents without the application returning the data directly. This vulnerability falls under CWE‑89 and can compromise the confidentiality of stored data.

The issue impacts the Quatuor Evaluación de Desempeño (EDD) product provided by Gabinete Técnico de Programación. All versions of the application prior to the release dated November 12 2025 are susceptible. No other product variants were identified.

Security scoring lists a CVSS base score of 9.3 and an EPSS of less than 1 %, indicating a high severity but a low probability of being actively exploited today. The vulnerability is not included in the CISA KEV catalog. Exploitation would typically be performed by a remote attacker sending crafted requests to the vulnerable endpoint, possibly leveraging web traffic to trigger external database callbacks. Given the high impact, organizations should treat this as a critical risk even though the exploitation likelihood is currently low.