CVE-2026-25513
📋 TL;DR
FacturaScripts contains a critical SQL injection vulnerability in its REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. This affects all API endpoints with sorting functionality in versions prior to 2025.81, potentially compromising database integrity and confidentiality.
💻 Affected Systems
- FacturaScripts
📦 What is this software?
Facturascripts by Facturascripts
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Data exfiltration, unauthorized data modification, and potential lateral movement within the database environment.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, though some data exposure may still occur.
🎯 Exploit Status
SQL injection through sort parameter is well-understood attack vector; exploitation requires API authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.81
Vendor Advisory: https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cjfx-qhwm-hf99
Restart Required: No
Instructions:
1. Backup your FacturaScripts installation and database. 2. Update to version 2025.81 or later via the built-in updater or manual installation. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable REST API
allTemporarily disable the REST API to prevent exploitation while planning upgrade.
Modify configuration to disable REST API endpoints
Input Validation Filter
allImplement input validation for sort parameters at the web server or application firewall level.
Configure WAF rules to block SQL injection patterns in sort parameters
🧯 If You Can't Patch
- Restrict API access to trusted IP addresses only
- Implement strict API authentication and monitor for unusual sort parameter patterns
🔍 How to Verify
Check if Vulnerable:
Check FacturaScripts version in admin panel or via version file; if version is below 2025.81, system is vulnerable.Check Version:
Check /vendor/composer/installed.json or admin panel version displayVerify Fix Applied:
Confirm version is 2025.81 or later and test API sort functionality with malicious inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed sort parameter attempts
- API requests with SQL keywords in sort parameter
Network Indicators:
- Unusual API traffic patterns
- SQL injection payloads in HTTP requests
SIEM Query:
source="web_logs" AND (uri_path="/api/*" AND query_string="*sort=*" AND (query_string="*SELECT*" OR query_string="*UNION*" OR query_string="*OR*"))