CVE-2025-41370 Overview
CVE-2025-41370 is a SQL injection vulnerability [CWE-89] in Gandia Integra Total by TESI. The flaw affects versions 2.1.2217.3 through 4.4.2236.1. An authenticated attacker can manipulate the idestudio parameter in /encuestas/integraweb/html/view/acceso.php to execute arbitrary SQL statements. Successful exploitation allows attackers to read, create, update, and delete databases backing the survey platform. The vulnerability was disclosed through INCIBE CERT and assigned a CVSS 4.0 score reflecting high impact to confidentiality, integrity, and availability.
Critical Impact
Authenticated attackers can fully compromise backend databases, including reading sensitive survey data and tampering with or destroying records.
Affected Products
- Tesigandia Gandia Integra Total version 2.1.2217.3
- Tesigandia Gandia Integra Total versions through 4.4.2236.1
- Deployments exposing /encuestas/integraweb/html/view/acceso.php
Discovery Timeline
- 2025-08-01 - CVE-2025-41370 published to NVD
- 2025-10-08 - Last updated in NVD database
Technical Details for CVE-2025-41370
Vulnerability Analysis
The vulnerability resides in the acceso.php endpoint located at /encuestas/integraweb/html/view/. The application accepts the idestudio request parameter and incorporates its value into a SQL statement without proper sanitization or parameterization. An authenticated user can inject SQL syntax through this parameter, breaking out of the intended query context.
Because the injection occurs in a data-access path used by the survey platform, attackers gain direct interaction with the backing database. Operations include SELECT to exfiltrate study and respondent data, INSERT and UPDATE to tamper with records, and DROP or DELETE to destroy data sets. The CWE-89 classification confirms unsanitized concatenation of untrusted input into a SQL query.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command. The idestudio parameter is concatenated into a query string rather than bound through parameterized statements or prepared queries. No allow-list validation or type enforcement is applied before the value reaches the database driver.
Attack Vector
The attack is network-reachable and requires only valid authenticated access to the application. An attacker submits a crafted HTTP request to /encuestas/integraweb/html/view/acceso.php with a malicious idestudio value. Payloads commonly use union-based, boolean-based, or time-based techniques to extract data or execute write operations. No user interaction is required beyond the attacker's own session.
No verified proof-of-concept code is publicly available. Refer to the INCIBE CERT advisory for additional technical context.
Detection Methods for CVE-2025-41370
Indicators of Compromise
- HTTP requests to /encuestas/integraweb/html/view/acceso.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 within the idestudio parameter.
- Database audit log entries showing schema modifications (CREATE, DROP, ALTER) initiated by the Integra application service account outside of maintenance windows.
- Unexpected INFORMATION_SCHEMA queries originating from the Integra web tier.
Detection Strategies
- Inspect web server and application logs for non-numeric values in the idestudio parameter, since the field is expected to be an integer study identifier.
- Deploy WAF signatures targeting SQL injection patterns specifically on the acceso.php endpoint.
- Correlate authenticated session activity with sudden spikes in database query volume or query latency consistent with time-based blind injection.
Monitoring Recommendations
- Enable verbose query logging on the Microsoft SQL Server or MySQL instance backing Gandia Integra and forward logs to a centralized analytics platform.
- Alert on authenticated users issuing data-definition statements through the web application service account.
- Baseline normal request rates to acceso.php and trigger alerts on deviations indicating automated injection tooling such as sqlmap.
How to Mitigate CVE-2025-41370
Immediate Actions Required
- Contact TESI to obtain a fixed build above version 4.4.2236.1 and apply it across all production and staging environments.
- Restrict network access to the Integra web interface to trusted corporate networks or VPN ranges until patching is complete.
- Rotate credentials for all application and database service accounts after confirming no prior compromise occurred.
Patch Information
No public vendor advisory URL was listed in the CVE record at the time of publication. Customers should consult the INCIBE CERT notification and engage TESI support directly to confirm the remediated version and obtain upgrade instructions.
Workarounds
- Place a web application firewall in front of the Integra application with rules blocking SQL metacharacters in the idestudio parameter.
- Enforce least-privilege on the database account used by Integra so it cannot execute DROP, CREATE, or ALTER statements.
- Review and disable inactive application accounts to reduce the pool of credentials usable for authenticated exploitation.
# Example WAF rule (ModSecurity) blocking SQLi in idestudio
SecRule ARGS:idestudio "@rx (?i)(union(\s|\+)+select|sleep\s*\(|--|;|/\*|\bor\b\s+\d+=\d+)" \
"id:1004137,phase:2,deny,status:403,log,msg:'CVE-2025-41370 SQLi attempt in idestudio'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
