{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/facturascripts/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FacturaScripts"],"_cs_severities":["critical"],"_cs_tags":["sql-injection","web-application","facturascripts","account-takeover","credential-access","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["FacturaScripts"],"content_html":"\u003cp\u003eA critical authenticated SQL injection vulnerability (GHSA-5qmh-x653-g8qj) has been discovered in FacturaScripts, a popular ERP/CRM system, specifically impacting its REST API endpoints such as \u003ccode\u003e/api/3/clientes\u003c/code\u003e and \u003ccode\u003e/api/3/attachedfiles\u003c/code\u003e. This flaw stems from an insecure design in the \u003ccode\u003eWhere::sqlColumn()\u003c/code\u003e function which fails to escape SQL identifiers that contain both opening and closing parentheses, allowing an attacker to inject arbitrary SQL into the \u003ccode\u003efilter\u003c/code\u003e parameter of API requests. An attacker with a legitimate, even low-privileged, API key (e.g., read-only access to a single resource) can leverage this vulnerability to bypass intended access controls. The exploit was verified on 2026-04-30 against a stock FacturaScripts master instance, demonstrating the ability to leak sensitive information such as admin password hashes and session cookies (\u003ccode\u003elogkey\u003c/code\u003e), ultimately leading to full administrative account takeover without requiring CSRF protection or two-factor authentication bypasses. This vulnerability poses a significant risk to the confidentiality and integrity of FacturaScripts deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access with Low-Privilege API Key:\u003c/strong\u003e An attacker obtains a valid, low-privileged API key, for example, a token with \u003ccode\u003eallowget=1\u003c/code\u003e on the \u003ccode\u003eclientes\u003c/code\u003e resource and \u003ccode\u003efullaccess=0\u003c/code\u003e, typically intended for integrations or limited data retrieval.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCrafted SQL Injection Request:\u003c/strong\u003e The attacker sends a GET request to a vulnerable API endpoint, such as \u003ccode\u003e/api/3/clientes\u003c/code\u003e, including a maliciously crafted \u003ccode\u003efilter\u003c/code\u003e parameter. The payload within the \u003ccode\u003efilter\u003c/code\u003e parameter contains SQL injection syntax, specifically leveraging parentheses to bypass the \u003ccode\u003eWhere::sqlColumn()\u003c/code\u003e escaping mechanism (e.g., \u003ccode\u003efilter[(0)UNION SELECT ...]=\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDatabase Query Manipulation:\u003c/strong\u003e The FacturaScripts backend processes the request, and due to the \u003ccode\u003eWhere::sqlColumn()\u003c/code\u003e bypass, the attacker's SQL payload is concatenated directly into the database query, allowing for arbitrary SQL execution.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInformation Leakage (Password Hash):\u003c/strong\u003e The injected SQL query (e.g., \u003ccode\u003eUNION SELECT IFNULL(password,2),... FROM users WHERE(nick='admin')\u003c/code\u003e) extracts sensitive data like the admin user's bcrypt password hash from the \u003ccode\u003eusers\u003c/code\u003e table.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInformation Leakage (Session Cookie):\u003c/strong\u003e The attacker repeats the process with a modified SQL injection payload to extract the admin user's \u003ccode\u003elogkey\u003c/code\u003e (web session cookie value).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSession Hijacking:\u003c/strong\u003e With the leaked \u003ccode\u003elogkey\u003c/code\u003e, the attacker creates a forged session cookie for the admin user.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccount Takeover:\u003c/strong\u003e The attacker uses the forged session cookie to access administrative interfaces (e.g., \u003ccode\u003e/AdminPlugins\u003c/code\u003e) of the FacturaScripts application, achieving full administrative account takeover.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary Command Execution (Optional):\u003c/strong\u003e Time-based blind SQL injection techniques (e.g., \u003ccode\u003e(SELECT(SLEEP(2)))\u003c/code\u003e) can also be employed to confirm the vulnerability in scenarios where \u003ccode\u003eUNION SELECT\u003c/code\u003e isn't feasible due to column count mismatches.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this vulnerability leads to a severe cross-resource confidentiality breach and complete account takeover. An attacker starting with only a read-only API key for a single resource can escalate privileges to full administrator access. This allows them to read any data from any database table, including user credentials (password hashes), API keys, and sensitive business information. The attacker gains the ability to hijack administrator web sessions, granting them unfettered control over the FacturaScripts instance, including the installation of plugins, modification of settings, and potential data exfiltration or manipulation. The attack bypasses existing serialization protections for sensitive fields and API key scoping, making it a critical threat to data security and system integrity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect FacturaScripts Authenticated SQL Injection Attempt\u003c/code\u003e to your webserver logs to identify attempts at this exploitation.\u003c/li\u003e\n\u003cli\u003eReview webserver access logs for requests containing patterns like \u003ccode\u003efilter%5B%28\u003c/code\u003e combined with \u003ccode\u003eUNION%20SELECT\u003c/code\u003e or \u003ccode\u003eSLEEP%28\u003c/code\u003e in \u003ccode\u003ecs-uri-query\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePatch FacturaScripts installations immediately to address GHSA-5qmh-x653-g8qj once a fix is available, prioritizing internet-facing instances.\u003c/li\u003e\n\u003cli\u003eImplement stringent API key management, including regular rotation and least-privilege principles, though this vulnerability demonstrates how such controls can be bypassed.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual administrator logins or activities originating from new or unexpected IP addresses, especially after suspicious API requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-14T19:17:37Z","date_published":"2026-07-14T19:17:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-facturascripts-sql-injection/","summary":"An authenticated SQL injection vulnerability exists in the FacturaScripts REST API, specifically in the `filter` parameter of endpoints like `/api/3/clientes` and `/api/3/attachedfiles`. This flaw arises because the `Where::sqlColumn()` function bypasses identifier escaping for strings containing both parentheses, allowing an attacker to inject arbitrary SQL, which enables an attacker with a low-privileged API key to extract sensitive data like admin password hashes and session cookies (`logkey`) from any database table, leading to full account takeover and administrative access.","title":"FacturaScripts Authenticated SQL Injection via Parenthesis Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-facturascripts-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - FacturaScripts","version":"https://jsonfeed.org/version/1.1"}