Attack Chain

1. A low-privilege authenticated user logs into the FacturaScripts application.
2. The user navigates to a data entry form (e.g., EditCliente) and injects a malicious formula, such as =SUM(1+1)*cmd|/c calc!A1, into a text field (e.g., nombre).
3. FacturaScripts stores the input verbatim in the database because the Tools::noHtml() sanitization function (located at Core/Tools.php:45) only strips HTML metacharacters and not formula-triggering characters.
4. An administrator, performing routine tasks, initiates a CSV export of the affected data (e.g., ListCliente via ?action=export&option=CSV).
5. The CSVExport::writeData() function in FacturaScripts exports the malicious formula unescaped into the generated CSV file.
6. The administrator's web browser downloads the CSV file (e.g., export.csv) to their local machine.
7. The administrator opens the downloaded CSV file using a spreadsheet application (e.g., Microsoft Excel or LibreOffice Calc) on their workstation.
8. The spreadsheet application interprets and executes the embedded formula, leading to arbitrary code execution (e.g., calc.exe via DDE) or credential theft on the administrator's workstation.

Impact

Successful exploitation of this vulnerability leads to severe consequences for organizations using FacturaScripts. Attackers can achieve arbitrary code execution on administrator workstations, effectively gaining a beachhead for further compromise and potentially full host takeover. This direct access can facilitate credential theft, exfiltrating sensitive information such as customer names, fiscal IDs, and financial balances, especially through common variants like =HYPERLINK or =WEBSERVICE payloads. The attack leverages the trusted context of a downloaded internal ERP report, bypassing standard security hygiene that would otherwise flag untrusted spreadsheets. Any organization utilizing FacturaScripts, particularly those where low-privilege users can modify records and administrators regularly export data, is at risk.

Recommendation

• Patch CVE-2026-45263 immediately by updating FacturaScripts to a version where the vulnerability is resolved or by applying the recommended code fix provided in the GitHub advisory.
• Deploy the provided Sigma rule to detect suspicious process creation activities originating from spreadsheet applications, which could indicate successful CSV formula injection exploitation.
• Enable comprehensive process_creation logging on all endpoint detection and response (EDR) agents to capture the ParentImage and Image fields for all executed processes, which is crucial for activating the rule above.