CVE-2025-41372: Gandia Integra Total SQLi Vulnerability

CVE-2025-41372 Overview

CVE-2025-41372 is a SQL injection vulnerability [CWE-89] in Gandia Integra Total developed by TESI. The flaw affects versions from 2.1.2217.3 through 4.4.2236.1. An authenticated attacker can inject arbitrary SQL through the idestudio parameter in /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php. Successful exploitation lets the attacker read, create, modify, and delete database records. The vulnerability was disclosed through INCIBE-CERT and assigned a CVSS 4.0 score of 8.7.

Critical Impact
Authenticated attackers can fully compromise the application database, including reading sensitive survey data and destroying records, by injecting SQL via the idestudio parameter.

Affected Products

Tesigandia Gandia Integra Total version 2.1.2217.3
Tesigandia Gandia Integra Total versions through 4.4.2236.1
Affected endpoint: /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php

Discovery Timeline

2025-08-01 - CVE-2025-41372 published to NVD
2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-41372

Vulnerability Analysis

The vulnerability resides in the informe_campo_entrevistas.php reporting endpoint within the Integra web application. The idestudio HTTP parameter is concatenated directly into a backend SQL statement without parameterization or sanitization. An authenticated user with low privileges can supply crafted input that breaks out of the original query context and appends arbitrary SQL clauses.

Because the injection occurs in a server-side database query, attackers can execute SELECT, INSERT, UPDATE, and DELETE statements against tables the application's database user can reach. Survey data, respondent identifiers, and configuration tables stored by the Integra platform are within scope.

The attack is delivered over the network and requires only the privileges already granted to a standard authenticated user. No user interaction is required, and exploitation is straightforward using common SQL injection techniques such as UNION-based extraction or stacked queries depending on the database driver.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The idestudio parameter is treated as trusted input and inserted into a dynamic SQL string. Prepared statements or strict integer casting on idestudio would have prevented the issue.

Attack Vector

Exploitation requires a valid session against the Integra web application. The attacker issues an HTTP request to informe_campo_entrevistas.php and replaces the expected numeric idestudio value with a SQL payload. The injected fragment alters the WHERE clause or chains additional statements, returning extracted data in the report response or modifying records silently.

No verified public proof-of-concept code is available. Technical details are described in the INCIBE Security Notice.

Detection Methods for CVE-2025-41372

Indicators of Compromise

HTTP requests to /encuestas/integraweb/integra/html/view/informe_campo_entrevistas.php or the integraweb_v4 variant where the idestudio parameter contains non-numeric characters, single quotes, comment markers (--, /*), or SQL keywords such as UNION, SELECT, SLEEP, or DROP.
Web server access logs showing repeated requests to informe_campo_entrevistas.php from a single authenticated session with varying idestudio payloads.
Database error messages or unusual SELECT and UPDATE activity originating from the Integra application service account outside normal reporting windows.

Detection Strategies

Deploy WAF rules that validate idestudio as a strict integer and block requests containing SQL metacharacters before they reach the application.
Enable database query auditing to flag statements referencing system tables or executing data-modification commands from the Integra application user.
Correlate authenticated session activity with abnormal report endpoint usage to surface credential abuse against the reporting module.

Monitoring Recommendations

Monitor HTTP 500 responses and database error patterns from the Integra application as a signal of probing.
Alert on outbound data volumes from the Integra database server that deviate from baseline reporting workloads.
Track authentication events for Integra accounts performing report queries outside business hours or from unfamiliar source addresses.

How to Mitigate CVE-2025-41372

Immediate Actions Required

Identify all Integra Total deployments and confirm the installed version against the affected range 2.1.2217.3 through 4.4.2236.1.
Contact TESI to obtain a fixed build of Gandia Integra Total and schedule the upgrade.
Restrict network access to the Integra web interface to trusted administrative networks and required survey users only.
Rotate credentials for accounts that authenticated to vulnerable instances and review database audit logs for prior abuse.

Patch Information

No vendor patch URL is published in the CVE record. Refer to the INCIBE Security Notice and contact TESI directly to obtain a remediated version of Gandia Integra Total.

Workarounds

Place the Integra application behind a web application firewall configured to enforce integer-only values for the idestudio parameter.
Reduce the privileges of the database account used by Integra so it cannot execute schema changes or data modification statements beyond what reports require.
Disable or block access to informe_campo_entrevistas.php at the reverse proxy until the vendor fix is deployed if the report is non-essential.

bash

# Example nginx rule to enforce numeric idestudio values
location ~ /encuestas/integraweb(_v4)?/integra/html/view/informe_campo_entrevistas\.php$ {
    if ($arg_idestudio !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://integra_backend;
}