CVE-2025-41377 Overview
CVE-2025-41377 is a SQL injection vulnerability [CWE-89] in Gandia Integra Total by TESI. The flaw affects versions 2.1.2217.3 through 4.4.2236.1. An authenticated attacker can manipulate the idestudio parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php to inject arbitrary SQL statements.
Successful exploitation allows attackers to read, create, update, and delete database records. The vulnerability requires only low-privileged authentication and no user interaction over the network.
Critical Impact
Authenticated attackers can compromise the confidentiality, integrity, and availability of all data stored in the Gandia Integra Total backend database.
Affected Products
- Gandia Integra Total version 2.1.2217.3
- Gandia Integra Total versions up to 4.4.2236.1
- TESI Gandia Integra Total integraweb and integraweb_v4 components
Discovery Timeline
- 2025-05-23 - CVE CVE-2025-41377 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-41377
Vulnerability Analysis
The vulnerability resides in the consultacuotasred.php script located under /encuestas/integraweb[_v4]/integra/html/view/. The script accepts an idestudio HTTP parameter and concatenates it directly into a SQL query without parameterization or input validation. This classic SQL injection pattern allows attackers to break out of the intended query context and append arbitrary SQL syntax.
Because the injection point sits in a query path that executes against the application database, attackers can extract sensitive survey and respondent data, modify records, or drop tables. The flaw is reachable by any account that can authenticate to the application, regardless of role privileges within Gandia Integra Total.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application fails to use prepared statements or parameterized queries when handling the idestudio value. User-controlled input flows directly into the SQL string passed to the database driver.
Attack Vector
The attack vector is network-based and requires authentication. An attacker sends a crafted HTTP request to /encuestas/integraweb_v4/integra/html/view/consultacuotasred.php with a malicious idestudio parameter. Payloads typically include union-based selects, boolean-based blind probes, or stacked queries to read or modify the underlying database. The vulnerability manifests directly through HTTP parameter manipulation. See the INCIBE Security Notice for additional technical context.
Detection Methods for CVE-2025-41377
Indicators of Compromise
- HTTP requests to consultacuotasred.php containing SQL metacharacters such as ', --, UNION, SELECT, or ; in the idestudio parameter
- Database error messages or unusually long response times tied to requests against the idestudio parameter
- Unexpected CREATE, UPDATE, or DELETE statements in database audit logs originating from the Gandia Integra application user
Detection Strategies
- Deploy web application firewall (WAF) signatures that flag SQL injection payloads in the idestudio query parameter
- Enable database query logging and alert on schema-modifying statements issued by the web application service account
- Review application access logs for high request volume to consultacuotasred.php from a single authenticated session
Monitoring Recommendations
- Correlate authenticated session activity with anomalous database query patterns originating from the Gandia Integra web tier
- Monitor outbound data volume from the database host for signs of bulk extraction
- Alert on the creation of new database users, tables, or stored procedures outside of approved change windows
How to Mitigate CVE-2025-41377
Immediate Actions Required
- Restrict network access to the Gandia Integra Total web interface to trusted internal networks only
- Audit and reduce the privileges of the database account used by the application, removing CREATE, DROP, and ALTER rights where possible
- Review authentication logs and revoke credentials that show signs of misuse
- Contact TESI for an updated build that addresses the idestudio parameter sanitization
Patch Information
No public patch reference is listed in the NVD entry at the time of writing. Refer to the INCIBE Security Notice for vendor coordination details and contact TESI directly for a fixed version beyond 4.4.2236.1.
Workarounds
- Place a WAF in front of the application with rules that block SQL injection payloads targeting the idestudio parameter
- Enforce strict input validation at a reverse proxy by rejecting non-numeric values for idestudio
- Disable or restrict access to /encuestas/integraweb_v4/integra/html/view/consultacuotasred.php until a vendor fix is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
