CVE-2025-41372 is a high-severity SQL injection vulnerability affecting Gandia Integra Total of TESI versions 2.1.2217.3 through 4.4.2236.1. An authenticated attacker can exploit this flaw via the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php to achieve full database manipulation, including retrieval, creation, updating, and deletion. With a CVSS score of 8.8 (High), the vulnerability requires low privileges and no user interaction, posing a significant risk to data confidentiality, integrity, and availability. Currently, there is no public exploit code, Metasploit module, or evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.1.2217.3, <= 4.4.2236.1CPE matchmatch criteria | cpe:2.3:a:tesigandia:gandia_integra_total:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.