CVE-2025-41371 Overview
CVE-2025-41371 is a SQL injection vulnerability in Gandia Integra Total, a survey management platform developed by TESI. The flaw resides in the idestudio parameter of the /encuestas/integraweb_v4/integra/html/view/acceso.php endpoint. Authenticated attackers can inject arbitrary SQL statements to read, create, modify, and delete database records. The vulnerability affects versions from 2.1.2217.3 through 4.4.2236.1. The Spanish National Cybersecurity Institute (INCIBE) coordinated the disclosure with the vendor.
Critical Impact
Authenticated attackers can fully compromise the underlying database, including extraction and destruction of stored survey data.
Affected Products
- Gandia Integra Total version 2.1.2217.3
- Gandia Integra Total versions up to 4.4.2236.1
- TESI Gandia Integra Total web component (integraweb_v4)
Discovery Timeline
- 2025-08-01 - CVE-2025-41371 published to NVD
- 2025-10-08 - Last updated in NVD database
Technical Details for CVE-2025-41371
Vulnerability Analysis
The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The acceso.php script accepts the idestudio parameter and embeds it into a backend SQL query without parameterization or input sanitization. An authenticated attacker can append SQL syntax to alter the query logic.
Successful exploitation allows the attacker to read arbitrary tables, insert new rows, update existing records, and drop database objects. Because the injection executes under the application's database account, the attacker inherits all privileges granted to that account. In typical Integra deployments, that account holds read and write access to survey datasets, user tables, and configuration records.
The vulnerability is network-accessible and requires no user interaction beyond the initial authentication. The EPSS score is 0.063%, reflecting limited public exploitation activity at the time of writing.
Root Cause
The idestudio parameter is concatenated directly into a SQL statement constructed in acceso.php. The application does not use prepared statements, parameter binding, or type validation. Any string containing SQL metacharacters reaches the database engine intact.
Attack Vector
An attacker authenticates to the Integra web application, then issues a crafted HTTP request to /encuestas/integraweb_v4/integra/html/view/acceso.php with a malicious idestudio value. The injected payload terminates the original query and appends attacker-controlled SQL, including UNION SELECT statements for data extraction or UPDATE and DELETE statements for tampering. Refer to the INCIBE Security Notice for vendor-coordinated technical details.
Detection Methods for CVE-2025-41371
Indicators of Compromise
- HTTP requests to /encuestas/integraweb_v4/integra/html/view/acceso.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the idestudio parameter.
- Database error messages or stack traces returned to authenticated session logs that reference idestudio or acceso.php.
- Unexpected INSERT, UPDATE, or DELETE operations executed by the Integra application database account outside normal business hours.
Detection Strategies
- Inspect web server access logs for non-numeric values in the idestudio query string parameter, since the field is expected to contain a numeric study identifier.
- Deploy a web application firewall (WAF) rule set with SQL injection signatures targeting the acceso.php path.
- Enable database query auditing to flag queries containing the idestudio value alongside SQL keywords inconsistent with the application's standard query templates.
Monitoring Recommendations
- Forward Integra web and database logs to a centralized SIEM and correlate authentication events with anomalous query patterns.
- Alert on sustained 4xx or 5xx responses from acceso.php, which often accompany injection probing.
- Track authenticated session activity for accounts issuing requests with payload lengths or character distributions inconsistent with normal traffic.
How to Mitigate CVE-2025-41371
Immediate Actions Required
- Upgrade Gandia Integra Total to a fixed release as published by TESI through the INCIBE Security Notice.
- Restrict access to the Integra web application using network controls, VPN, or IP allowlists until patching is complete.
- Audit application and database logs for prior exploitation attempts referencing idestudio or acceso.php.
- Rotate credentials for any database accounts used by Integra and review survey data for unauthorized modification.
Patch Information
TESI has coordinated remediation through INCIBE-CERT. Administrators should contact the vendor for the fixed build that supersedes version 4.4.2236.1 and follow the upgrade instructions in the INCIBE Security Notice.
Workarounds
- Place a web application firewall in front of the Integra application with rules blocking SQL metacharacters in the idestudio parameter.
- Reduce the privileges of the Integra database account to the minimum required for application function, removing rights to drop tables or modify schema where possible.
- Disable or restrict access to the acceso.php endpoint at the reverse proxy layer if it is not required for active surveys.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
