The vulnerability is an out‑of‑band SQL injection in the 'Id_evaluacion' parameter of the '/evaluacion_objetivos_evalua_definido.aspx' page. An attacker could issue commands that are transmitted through external channels to retrieve sensitive data from the underlying database, thereby undermining confidentiality. This flaw aligns with CWE‑89, highlighting improper handling of SQL statements.

The affected product is the Quatuor Evaluación de Desempeño (EDD) application, which is vulnerable in versions released before November 12 2025. The latest build, released on that date, contains the fix and is no longer exploitable. The application is accessed via a web interface hosted by Gabinete Técnico de Programación.

The CVSS score of 9.3 denotes critical severity, but the EPSS score is under 1 %, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. Based on the description, the attack vector is likely remote, web‑based, and requires unauthenticated or authenticated access to the affected URL with a crafted parameter. An attacker must be able to observe the outbound traffic or influence outgoing channels to retrieve the injected payload results.