Quatuor Performance Evaluation Out-of-Band SQL Injection Vulnerability

A critical out-of-band SQL injection vulnerability has been identified in the Performance Evaluation (EDD) application by Gabinete Técnico de Programación. The vulnerability exists in the 'Id_usuario' parameter of '/evaluacion_acciones_ver_auto.aspx'. Exploiting this flaw could enable an attacker to extract sensitive database information through external channels, bypassing direct application response and compromising data confidentiality.

Impact

Exploitation allows for unauthorized data extraction from the database, undermining the confidentiality of the information stored.

Remediation

The vulnerability has been addressed in the latest version of the application, released on November 12, 2025.