SB20261109205 - Multiple vulnerabilities in FacturaScripts

Description

This security bulletin contains information about 2 vulnerabilities.

1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated low-privilege attacker to extract sensitive database contents from FacturaScripts, including administrator password hashes and API keys.

The vulnerability exists due to unvalidated concatenation of the fieldcode parameter into SQL queries by Variante::codeModelSearch() when autocomplete requests specify source=Variante. A remote authenticated low-privilege attacker can submit a crafted request through an accessible List or Panel controller and retrieve arbitrary database values directly in the autocomplete response.

2) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged authenticated attacker to extract sensitive database contents through blind SQL injection in FacturaScripts.

The vulnerability exists due to missing field-name validation in the autocomplete endpoint's JoinModel branch, which inserts request-controlled field names containing parentheses directly into SQL queries. A low-privileged authenticated attacker with access to a List or Panel controller can submit crafted autocomplete requests and use blind extraction to retrieve customer data and authentication secrets.

Remediation

Install update from vendor's website.

References

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pmhg-rhr4-5624
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-7598-jq2v-gmxf