CVE-2026-45262 facturascripts CVE debrief

Who should care

System administrators and developers using FacturaScripts, especially those with exposed REST API or sensitive data, should assess their exposure and implement necessary mitigations.

Why it matters

This authenticated SQL injection vulnerability in the FacturaScripts REST API filter parameter poses a significant risk to systems using the software, particularly those with exposed API endpoints. An attacker could exploit this vulnerability to gain unauthorized access, potentially leading to data breaches or system compromise.

• Potential for end-to-end account takeover using a read-only token
• Possible data exposure or modification through SQL injection
• Bypass of intended access controls due to lack of proper input validation
• Potential for lateral movement within the system

Technical summary

The vulnerability exists in the FacturaScripts REST API due to improper handling of user input in the filter parameter. Specifically, the `Core/Where.php::sqlColumn()` function exempts field names containing both `(` and `)` from identifier escaping. This allows an attacker to inject malicious SQL code, potentially leading to data exposure or modification. The API filter builders (`APIModel::getWhereValues` and `ApiAttachedFiles::getWhereValues`) feed the raw request key (`$_GET['filter'][$key]`) straight into `new DataBaseWhere($key, $value, '=', ...)`. An attacker can exploit this vulnerability to gain unauthorized access, potentially leading to data breaches or system compromise.

Defensive priority

High priority for systems using FacturaScripts, especially those with exposed REST API.

Recommended defensive actions

• Immediately update FacturaScripts to version 2026.2 or later
• Restrict access to REST API for sensitive operations
• Implement additional authentication and authorization checks for API requests
• Monitor for suspicious API activity and implement logging and alerting
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Verified PoC exists, demonstrating end-to-end account takeover using a read-only token with no additional privileges. The PoC was verified on a stock FacturaScripts master at `127.0.0.1:8081` on 2026-04-30. The exploit involves issuing a `GET /api/3/clientes?filter[(0)UNION%20SELECT%20...]=` request, which returns the raw bcrypt hash of the admin user's password and the admin's `logkey` cookie value. The leaked `logkey` can be injected into a fresh cookie jar to access the admin plugin management UI.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.