CVE-2026-25513: FacturaScripts SQL Injection Vulnerability

CVE-2026-25513 Overview

CVE-2026-25513 is a critical SQL injection vulnerability affecting FacturaScripts, an open-source enterprise resource planning (ERP) and accounting software. Prior to version 2025.81, the application contains a severe flaw in its REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without proper validation or sanitization.

Critical Impact

Authenticated attackers can leverage this SQL injection vulnerability to extract sensitive financial data, customer records, and potentially gain unauthorized access to the underlying database, compromising the confidentiality of enterprise business data.

Affected Products

• FacturaScripts versions prior to 2025.81
• All REST API endpoints supporting sorting functionality
• Installations using PostgreSQL or MySQL database backends

Discovery Timeline

• 2026-02-04 - CVE-2026-25513 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25513

Vulnerability Analysis

This SQL injection vulnerability stems from improper input validation in the FacturaScripts REST API. The flaw resides in the ModelClass::getOrderBy() method, which processes user-supplied sorting parameters for API queries. When an authenticated user submits a request with a malicious sort parameter, the input is directly concatenated into the SQL ORDER BY clause without any sanitization or parameterized query handling.

The attack requires network access and low-privilege authentication to the REST API. Once exploited, an attacker can extract confidential data from the database, potentially including financial records, customer information, invoices, and other sensitive business data managed by the ERP system. The vulnerability affects all API endpoints that implement sorting functionality, significantly expanding the attack surface.

Root Cause

The root cause is categorized under CWE-20 (Improper Input Validation). The getOrderBy() method fails to validate or sanitize the sorting parameter before incorporating it into the SQL query. Instead of using parameterized queries or implementing an allowlist of permitted sort columns, the application directly concatenates user input into the ORDER BY clause, creating a classic SQL injection vector.

Attack Vector

The vulnerability is exploitable over the network by any authenticated API user. An attacker can craft malicious HTTP requests to any API endpoint that supports sorting, injecting SQL syntax through the sort parameter. This allows extraction of database contents through techniques such as UNION-based injection, error-based injection, or blind SQL injection, depending on the database configuration and error handling.

The security patch addresses this vulnerability by implementing proper column escaping in the database engine classes:

 
     public function castInteger($link, $column): string
     {
-        return 'CAST(' . $this->escapeColumn($link, $column) . ' AS unsigned)';
+        return 'CAST(' . $this->escapeColumn($link, $column) . ' AS integer)';
     }
 
     /**

Source: GitHub Commit Reference

Detection Methods for CVE-2026-25513

Indicators of Compromise

• Unusual or malformed sort parameter values in REST API request logs containing SQL syntax such as UNION, SELECT, --, or '
• Database query logs showing unexpected ORDER BY clauses with subqueries or UNION statements
• Anomalous API activity from authenticated users accessing multiple endpoints with sorting parameters
• Database errors in application logs indicating SQL syntax errors from the API layer

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the sort parameter across all API endpoints
• Deploy database activity monitoring to identify queries with suspicious ORDER BY clause constructions
• Enable detailed logging on FacturaScripts REST API endpoints and correlate with database query logs
• Use SentinelOne Singularity to monitor for process behaviors consistent with data exfiltration following API exploitation

Monitoring Recommendations

• Configure alerts for API requests containing SQL keywords in query parameters
• Monitor database connection patterns for unusual query volumes or data access from the application service account
• Implement rate limiting on API endpoints to slow potential automated exploitation attempts
• Review authentication logs for API users with anomalous access patterns or privilege escalation attempts

How to Mitigate CVE-2026-25513

Immediate Actions Required

• Upgrade FacturaScripts to version 2025.81 or later immediately
• Audit REST API access logs for evidence of exploitation attempts targeting the sort parameter
• Review database access patterns and query logs for signs of data exfiltration
• Temporarily restrict API access to trusted networks or users until patching is complete
• Rotate database credentials if compromise is suspected

Patch Information

The vulnerability has been patched in FacturaScripts version 2025.81. The fix implements proper sanitization in the DbQuery class and updates the database engine handlers to properly escape column references. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-cjfx-qhwm-hf99 and the security commit.

Workarounds

• Deploy a Web Application Firewall with SQL injection detection rules specifically targeting API endpoints
• Implement network-level restrictions to limit REST API access to trusted IP ranges
• Disable or restrict sorting functionality in API responses at the reverse proxy level until patching is possible
• Enable enhanced database query logging to detect and respond to exploitation attempts

# Configuration example - Restrict API access at nginx level
location /api/ {
    # Limit API access to internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Block common SQL injection patterns in query strings
    if ($query_string ~* "(union|select|insert|update|delete|drop|--|')") {
        return 403;
    }
    
    proxy_pass http://facturascripts_backend;
}