CVE-2025-41374
📋 TL;DR
A SQL injection vulnerability in Gandia Integra Total of TESI allows authenticated attackers to manipulate the 'idestudio' parameter to execute arbitrary SQL commands. This enables attackers to retrieve, create, update, and delete databases. Organizations using affected versions of this software are at risk.
💻 Affected Systems
- Gandia Integra Total of TESI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, destruction, or ransomware deployment, potentially leading to full system takeover.
Likely Case
Unauthorized data access and modification, privilege escalation, and potential lateral movement within the database environment.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and network segmentation restricting database access.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with basic tools like SQLmap when the attack vector is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
Restart Required: No
Instructions:
Check vendor advisory for updates. Apply patches when available. Implement input validation and parameterized queries in the meantime.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests.
Input Validation
allImplement strict input validation on the 'idestudio' parameter to allow only expected values.
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system from critical databases.
- Enforce principle of least privilege on database accounts used by the application.
🔍 How to Verify
Check if Vulnerable:
Test the 'idestudio' parameter with SQL injection payloads (e.g., ' OR '1'='1) in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.Check Version:
Check software version in administration panel or configuration files.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages or are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL injection patterns
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in the 'idestudio' parameter
SIEM Query:
source="web_logs" AND (url="*hislistadoacciones.php*" AND (param="*idestudio=*SELECT*" OR param="*idestudio=*UNION*"))