Name of the Vulnerable Software and Affected Versions:

Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1

Description:

A SQL injection vulnerability exists in Gandia Integra Total. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete databases through the `idestudio` parameter in the `/encuestas/integraweb[ v4]/integra/html/view/consultaincimails.php` API endpoint.

Recommendations:

Versions 2.1.2217.3 through 4.4.2236.1 are affected.

As a temporary workaround, restrict access to the `/encuestas/integraweb[ v4]/integra/html/view/consultaincimails.php` endpoint to minimize the risk of exploitation.