Executive brief
FacturaScripts is an open-source ERP and accounting system. A security vulnerability in its API allows an attacker with limited access to bypass security filters and run unauthorized database commands. This can lead to the theft of administrator passwords, full account takeover, and the ability to modify or delete sensitive financial and customer data.
Technical details
An authenticated SQL injection vulnerability exists in FacturaScripts versions up to 2026.1. The root cause is located in `Core/Where.php::sqlColumn()`, which fails to escape database identifiers if they contain both '(' and ')' characters. This logic was intended to support SQL expressions but lacks structural validation. Attackers can exploit this by providing a malicious SQL payload within the `filter` parameter of the REST API (e.g., `/api/3/clientes`). Because the API filter keys are not validated against an allow-list, the payload is concatenated directly into the WHERE clause. This allows for UNION-based or time-based blind SQL injection, enabling the extraction of sensitive data like bcrypt hashes and session 'logkeys' from the users table, leading to full administrative takeover.
Affected products
- NeoRazorX FacturaScripts <= 2026.1
Timeline
- 2026-04-30: other: Vulnerability verified via PoC
- 2026-07-14: advisory: GitHub Advisory published