CVE-2025-41374: Gandia Integra Total SQLi Vulnerability

CVE-2025-41374 Overview

CVE-2025-41374 is a SQL injection vulnerability affecting Gandia Integra Total from TESI. The flaw resides in the idestudio parameter handled by /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php. An authenticated attacker can inject arbitrary SQL statements to retrieve, create, update, and delete database records. Affected versions span from 2.1.2217.3 through 4.4.2236.1. The weakness is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can read and modify backend databases, leading to full compromise of survey data confidentiality and integrity.

Affected Products

Tesigandia Gandia Integra Total 2.1.2217.3 through 4.4.2236.1
integraweb web module (hislistadoacciones.php endpoint)
integraweb_v4 web module (hislistadoacciones.php endpoint)

Discovery Timeline

2025-08-01 - CVE-2025-41374 published to NVD
2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-41374

Vulnerability Analysis

The vulnerable endpoint /encuestas/integraweb/integra/html/view/hislistadoacciones.php (and its integraweb_v4 counterpart) accepts the idestudio request parameter without proper sanitization or parameterized query enforcement. An authenticated user can append SQL syntax to this parameter, which the backend concatenates directly into a database query. Because the injection runs under the application's database account, the attacker inherits whatever permissions that account holds, typically including read and write access across the survey data store. INCIBE-CERT confirmed the issue in a coordinated advisory covering multiple flaws in the product.

Root Cause

The root cause is improper neutralization of user-controlled input passed through the idestudio HTTP parameter. The application builds SQL statements via string concatenation rather than prepared statements with bound parameters. No allowlist validation or type enforcement constrains the parameter to expected numeric study identifiers.

Attack Vector

Exploitation requires network access to the web application and valid authentication credentials. The attacker submits crafted HTTP requests to hislistadoacciones.php with malicious payloads in the idestudio parameter. Successful injection enables UNION-based data extraction, stacked statements for INSERT/UPDATE/DELETE operations, and potential lateral movement within the database schema. No user interaction is required beyond the attacker's own session. Refer to the INCIBE Security Notice for additional technical context.

Detection Methods for CVE-2025-41374

Indicators of Compromise

HTTP requests to hislistadoacciones.php containing SQL metacharacters such as ', --, ;, UNION, or SELECT within the idestudio parameter.
Web server access logs showing unusually long or URL-encoded idestudio values from a single authenticated session.
Database audit logs revealing INSERT, UPDATE, or DELETE statements originating from the survey application outside normal workflow patterns.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the idestudio parameter for SQL syntax tokens and block requests that fail strict integer validation.
Enable database query logging and alert on schema-modifying statements (DROP, ALTER, TRUNCATE) issued by the Integra application service account.
Correlate authentication events with subsequent anomalous parameter usage to identify compromised or abusive accounts.

Monitoring Recommendations

Forward web and database logs to a centralized analytics platform such as Singularity Data Lake to enable cross-source correlation and historical hunting.
Establish a baseline of legitimate idestudio values and alert on deviations in parameter length, character set, or request frequency.
Review authenticated user sessions for repeated access to hislistadoacciones.php from unusual source IP addresses or user agents.

How to Mitigate CVE-2025-41374

Immediate Actions Required

Upgrade Gandia Integra Total to a version released after 4.4.2236.1 once the vendor publishes a fixed build, per the INCIBE advisory.
Restrict network access to the Integra web interface to trusted internal networks or VPN users only.
Rotate credentials for any account that authenticated to the application during the exposure window.
Audit the database for unauthorized records, schema changes, or data exfiltration evidence.

Patch Information

TESI has been notified through INCIBE-CERT coordinated disclosure. Administrators should consult the vendor and the INCIBE Security Notice for the fixed release. Apply the vendor patch as soon as it becomes available and validate that the idestudio parameter is processed through parameterized queries.

Workarounds

Place the application behind a WAF with a rule set that enforces integer-only values for the idestudio parameter and blocks SQL keywords.
Limit the application's database account to least-privilege permissions, removing rights to modify schema or access unrelated tables.
Disable or restrict the hislistadoacciones.php endpoint at the reverse proxy level until the patch is applied.

bash

# Example NGINX rule blocking non-numeric idestudio values
location ~* /encuestas/integraweb(_v4)?/integra/html/view/hislistadoacciones\.php {
    if ($arg_idestudio !~ "^[0-9]+$") {
        return 403;
    }
    proxy_pass http://integra_backend;
}