CVE-2026-25514: FacturaScripts SQL Injection Vulnerability

CVE-2026-25514 Overview

CVE-2026-25514 is a SQL Injection vulnerability affecting FacturaScripts, an open-source enterprise resource planning (ERP) and accounting software solution. The vulnerability exists in the autocomplete functionality and allows authenticated attackers to extract sensitive data from the database, including user credentials, configuration settings, and all stored business data.

Critical Impact

Authenticated attackers can exploit the SQL injection flaw in FacturaScripts to exfiltrate sensitive business data, user credentials, and configuration settings from the underlying database.

Affected Products

• FacturaScripts versions prior to 2025.81

Discovery Timeline

• February 4, 2026 - CVE-2026-25514 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25514

Vulnerability Analysis

This SQL Injection vulnerability exists in the CodeModel::all() method within FacturaScripts. The fundamental issue stems from improper handling of user-supplied input where parameters are directly concatenated into SQL queries without proper sanitization or parameterized binding. This classic SQL injection pattern allows authenticated users to manipulate query logic and extract unauthorized data from the database.

The vulnerability is particularly concerning in an ERP context because such systems typically contain highly sensitive business information including financial records, customer data, supplier information, invoicing details, and user account credentials. An attacker who has gained even low-privilege authenticated access to the application can leverage this flaw to extract the entire database contents.

Root Cause

The root cause of CVE-2026-25514 is improper input validation (CWE-20) in the autocomplete functionality. User-supplied parameters are directly concatenated into SQL query strings within the CodeModel::all() method rather than using parameterized queries or prepared statements. This allows an attacker to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The vulnerability is exploitable over the network by authenticated users. An attacker with valid credentials to the FacturaScripts application can craft malicious input through the autocomplete functionality. By injecting SQL syntax into the vulnerable parameters, the attacker can modify the query logic to return data from other tables, bypass access controls, or extract sensitive information using techniques such as UNION-based injection, blind SQL injection, or error-based extraction.

The attack requires network access to the FacturaScripts installation and valid user credentials (even low-privilege accounts are sufficient). No user interaction is required beyond the initial authentication, making this vulnerability relatively straightforward to exploit once an attacker has gained any level of access to the system.

Detection Methods for CVE-2026-25514

Indicators of Compromise

• Unusual or malformed requests to autocomplete endpoints containing SQL syntax characters such as single quotes, double dashes, UNION keywords, or semicolons
• Database query logs showing unexpected UNION SELECT statements or attempts to query system tables
• Application error logs containing SQL syntax errors or database exceptions related to the autocomplete functionality
• Abnormal data access patterns where authenticated users are querying data outside their normal business scope

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in requests to FacturaScripts endpoints
• Enable database query logging and monitor for suspicious query patterns including UNION-based attacks, stacked queries, or attempts to access sensitive tables
• Deploy application-layer monitoring to detect anomalous autocomplete requests with unusual parameter lengths or character sets
• Configure intrusion detection systems (IDS) to alert on SQL injection signature patterns in network traffic

Monitoring Recommendations

• Regularly audit database access logs for unauthorized data extraction attempts
• Monitor authentication logs for accounts being used to send suspicious autocomplete requests
• Implement real-time alerting for database queries that attempt to access credential tables or system configuration data
• Review application logs for error patterns that may indicate SQL injection probing attempts

How to Mitigate CVE-2026-25514

Immediate Actions Required

• Upgrade FacturaScripts to version 2025.81 or later immediately to apply the official patch
• Review database access logs to determine if the vulnerability has been exploited prior to patching
• Rotate all database credentials and user passwords as a precaution if exploitation is suspected
• Implement network-level access controls to restrict access to the FacturaScripts installation while patching

Patch Information

The vulnerability has been addressed in FacturaScripts version 2025.81. The patch modifies the CodeModel::all() method to properly sanitize user input and use parameterized queries instead of direct string concatenation. Organizations should update to this version or later to remediate the vulnerability.

For detailed patch information, refer to the GitHub commit and the GitHub Security Advisory GHSA-pqqg-5f4f-8952.

Workarounds

• If immediate patching is not possible, disable or restrict access to the autocomplete functionality at the application or web server level
• Implement a Web Application Firewall (WAF) with SQL injection protection rules in front of the FacturaScripts installation
• Restrict network access to the FacturaScripts application to trusted IP ranges only
• Apply the principle of least privilege to database accounts used by FacturaScripts to limit the potential impact of exploitation