Quatuor Performance Evaluation Out-of-Band SQL Injection Vulnerability
Vulnerability
A critical out-of-band SQL injection vulnerability has been identified in the Performance Evaluation (EDD) application by Gabinete Técnico de Programación. This vulnerability allows attackers to exploit the 'Id_usuario' and 'Id_evaluacion' parameters in '/evaluacion_hca_evalua.aspx' to extract sensitive database information through external channels, bypassing direct application response and compromising data confidentiality.
Impact
Exploitation of this vulnerability could lead to unauthorized access and extraction of sensitive information from the database, through external channels, without the application directly returning the data.
Remediation
The vulnerability has been addressed in the latest version of the application, released on November 12, 2025.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.