This vulnerability is an out-of-band SQL injection that allows an attacker to cause the backend database to transmit sensitive data through an external channel, triggered via the Id_usuario parameter in the /evaluacion_objetivos_anyo_sig_ver_auto.aspx endpoint. Because the data is sent through an external channel rather than returned in the response, the intrusion can remain hidden from the application and only the confidentiality of the stored data is at risk. The weakness is enumerated as CWE‑89, reflecting inadequate handling of untrusted input in database queries.

The flaw affects the Quatuor Evaluación de Desempeño (EDD) performance evaluation application, all releases before the November 12 2025 patch. The application is used by Gabinete Técnico de Programación to store and retrieve performance metrics. No other vendors or products are listed as impacted.

The CVSS score of 9.3 indicates a high-severity condition, and the EPSS score of < 1 % suggests a low but non‑zero chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no mass‑deployment exploitation has been observed yet. The attack vector is likely remote and network-based: an attacker crafts a malicious Id_usuario value and sends it to the web endpoint, relying on the application’s outbound database connections to leak data via an external channel. Exploitation requires only that the target application be reachable and willing to process the parameter.