关联漏洞
标题：
TESI Gandia Integra Total SQL注入漏洞
(CVE-2025-41373)
描述：TESI Gandia Integra Total是西班牙TESI公司的一款基于Web的在线调查和数据分析系统。 TESI Gandia Integra Total 2.1.2217.3至4.4.2236.1版本存在SQL注入漏洞，该漏洞源于文件/encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php中参数idestudio存在SQL注入，可能导致数据库操作。
描述
PoC for CVE-2025-41373 Authenticated SQL Injection in Gandia Integra Total v2.1.2217.3–4.4.2236.1
介绍
# CVE-2025-41373 – SQL Injection in Gandia Integra Total
**Author:** Byte Reaper
**CVE:** CVE-2025-41373
**Vulnerability:** Authenticated SQL Injection
**Affected Path:** /encuestas/integraweb_v4/integra/html/view/hislistadoacciones.php?idestudio=<input>
**Description:**
This endpoint concatenates the `idestudio` parameter directly into an SQL query without proper sanitization or parameterization, allowing an attacker to inject arbitrary SQL. This PoC leverages both boolean-based and time-based techniques to detect and demonstrate the vulnerability.
## Usage
```
# Build
gcc exploit.c argparse.c -o exploit -lcurl
# Run exploit against <URL>
./exploit -u <URL>
# Verbose output
./exploit -u <URL> -v
# WAF detection mode
./exploit -u <URL> -w
Replace <URL> with the target base URL (e.g. http://127.0.0.1).
```
## References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-41373
- incibe : https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
## License :
MIT License
文件快照
[4.0K] /data/pocs/7295aff0249695bbfa58f7a5c69b9404931a3fed
├── [ 24K] exploit.c
├── [1.0K] LICENSE
└── [1.1K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。