Quatuor Performance Evaluation Out-of-Band SQL Injection Vulnerability

A critical out-of-band SQL injection vulnerability has been identified in the Performance Evaluation (EDD) application by Gabinete Técnico de Programación. The issue arises in the 'Id_evaluacion' parameter on the '/evaluacion_objetivos_evalua_definido.aspx' page. This vulnerability allows attackers to extract sensitive database information through external channels, bypassing direct application response, and compromising data confidentiality.

Impact

Exploitation of this vulnerability could lead to unauthorized data extraction from the application's database, allowing sensitive information to be accessed through external channels without the application's knowledge.

Remediation

The vulnerability has been addressed in the latest version of the application, released on November 12, 2025. Users are advised to update to this version.