Out-of-band SQL injection (OOB SQLi) has been identified in the Quatuor Performance Evaluation (EDD) application. The vulnerability is triggered by manipulating the 'Id_usuario' parameter in the '/evaluacion_objetivos_anyo_sig_evalua.aspx' page, allowing an attacker to send malicious SQL queries that are executed against the database. The query results are sent to an external channel rather than being returned directly by the application, enabling the attacker to exfiltrate sensitive data and compromise database confidentiality.

Systems running older releases of the Quatuor Performance Evaluation (EDD) application are affected. The issue is present in all versions prior to the latest release dated November 12, 2025. The product, developed by Gabinete Técnico de Programación, is used primarily within the Quatuor Evaluación de Desempeño environment.

The vulnerability carries a CVSS score of 9.3, indicating critical severity, but its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting low exploit probability in the current threat landscape. An attacker can trigger the OOB SQL injection by crafting requests to the exposed parameter without an authenticated session, potentially bypassing authentication barriers. By leveraging external channels, attackers can retrieve confidential data without triggering obvious application errors, making detection more difficult. The combined high severity and low likelihood emphasize the importance of timely patching.