CVE-2025-41373: Gandia Integra Total SQLi Vulnerability

CVE-2025-41373 Overview

CVE-2025-41373 is a SQL injection vulnerability [CWE-89] in Gandia Integra Total by TESI. The flaw affects versions from 2.1.2217.3 through v4.4.2236.1. An authenticated attacker can manipulate the idestudio parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php to inject arbitrary SQL statements. Successful exploitation allows the attacker to retrieve, create, update, and delete database records.

Critical Impact
An authenticated remote attacker can execute arbitrary SQL queries against the backend database, leading to full compromise of survey data confidentiality, integrity, and availability.

Affected Products

Tesigandia Gandia Integra Total 2.1.2217.3 through v4.4.2236.1
Integraweb component (integraweb and integraweb_v4)
hislistadoacciones.php view script

Discovery Timeline

2025-08-01 - CVE-2025-41373 published to NVD
2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-41373

Vulnerability Analysis

The vulnerability resides in the hislistadoacciones.php script within the Integraweb module of Gandia Integra Total. The script accepts the idestudio request parameter and concatenates it into a SQL query without proper sanitization or parameterization. An authenticated user with low privileges can supply crafted SQL syntax through this parameter. The backend then executes the injected statements with the database privileges of the application.

Because the application processes survey definitions, responses, and respondent records, exploitation exposes potentially sensitive personally identifiable information. The vulnerability is reachable over the network and requires only standard application credentials.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The idestudio parameter is interpolated directly into a dynamic SQL statement instead of being bound through prepared statements or parameterized queries. No server-side input validation or type enforcement is applied before the database call.

Attack Vector

Exploitation requires an authenticated session in the Integra web application. The attacker sends an HTTP request to /encuestas/integraweb/integra/html/view/hislistadoacciones.php or its integraweb_v4 equivalent and replaces the value of idestudio with SQL payloads. Typical payloads include UNION-based selects to exfiltrate data, stacked statements to modify records, and time-based blind techniques for inference. See the INCIBE Security Notice for additional technical context.

Detection Methods for CVE-2025-41373

Indicators of Compromise

HTTP requests to hislistadoacciones.php containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the idestudio parameter.
Database errors or unusually long response times originating from the Integraweb endpoints.
Unexpected CREATE, UPDATE, or DELETE statements in database audit logs initiated by the application service account.
Authenticated sessions issuing high volumes of requests to a single survey endpoint with varying idestudio values.

Detection Strategies

Deploy web application firewall signatures that flag SQL meta-characters in the idestudio parameter.
Enable database query logging and alert on statements referencing schema objects not normally accessed by the Integraweb application.
Correlate authentication events with subsequent requests to hislistadoacciones.php to identify anomalous post-login activity.

Monitoring Recommendations

Forward web server and database audit logs to a centralized analytics platform such as Singularity Data Lake for correlation against SQL injection patterns.
Monitor outbound network traffic from the application server for data staging or exfiltration following suspicious queries.
Track failed login attempts followed by parameter tampering on the affected endpoint.

How to Mitigate CVE-2025-41373

Immediate Actions Required

Restrict access to the Integraweb application to trusted networks or VPN users until a patched release is deployed.
Audit application accounts and revoke unused or shared credentials to limit the authenticated attack surface.
Review database audit logs for evidence of malicious idestudio values dating back to the affected version range.

Patch Information

TESI has published advisories through INCIBE-CERT. Administrators should consult the INCIBE Security Notice for the fixed release and upgrade to a version newer than v4.4.2236.1 once available from the vendor.

Workarounds

Place a web application firewall in front of the Integraweb application with rules blocking SQL syntax in the idestudio parameter.
Apply least-privilege principles to the database account used by Integraweb, removing CREATE, UPDATE, and DELETE rights where feasible.
Disable or restrict the hislistadoacciones.php endpoint at the web server level if it is not required for daily operations.

bash

# Example Apache rewrite rule to block SQL keywords in idestudio
RewriteEngine On
RewriteCond %{QUERY_STRING} (?i)idestudio=[^&]*(union|select|sleep|--|;) [NC]
RewriteRule ^/encuestas/integraweb(_v4)?/integra/html/view/hislistadoacciones\.php - [F,L]