An out-of-band SQL injection (OOB SQLi) flaw exists in the Quatuor Evaluación de Desempeño application. The vulnerability lies in the Id_usuario parameter of the /evaluacion_objetivos_ver_auto.aspx page. Attackers can craft malicious SQL that triggers external data transmission, allowing them to exfiltrate sensitive database content without the application returning the data directly. Consequently, the confidentiality of stored information is compromised. The weakness is classified as CWE‑89.

The affected product is Quatuor: Evaluación de Desempeño (EDD), developed by Gabinete Técnico de Programación. No specific version numbers are listed in the CNA data; the vendor claims that the issue is resolved in the latest release.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% reflects a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a malicious request to the Id_usuario parameter via the /evaluacion_objetivos_ver_auto.aspx endpoint, typically from an external network, to trigger the out‑of‑band data exfiltration. No authentication or special privileges are explicitly required, so any user who can access that endpoint could potentially exploit the flaw.