CVE-2026-25513: 
PHP vulnerability analysis and mitigation

CVE-2026-25513 is a SQL injection vulnerability in the REST API of FacturaScripts, an open-source ERP and accounting software. The flaw allows authenticated API users to execute arbitrary SQL queries by manipulating the sort parameter across all API endpoints that support sorting functionality. All versions prior to 2025.81 are affected. The vulnerability was discovered by Łukasz Rybak, disclosed via GitHub Security Advisory on February 3, 2026, and published to the NVD on February 4, 2026. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.3 (High) (Github Advisory, FacturaScripts Advisory).

The root cause is improper input validation (CWE-20, CWE-89) in two code locations: the legacy ModelClass::getOrderBy() method in /Core/Model/Base/ModelClass.php, which directly concatenates user-supplied sort keys and values into the SQL ORDER BY clause, and the modern DbQuery::orderBy() method in /Core/DbQuery.php, which attempted to allow SQL functions by checking for parentheses but failed to validate their content — permitting arbitrary SQL injection through expressions like (SELECT(SLEEP(3))). The attack vector is network-based, requires low privileges (a valid API key), and no user interaction. An attacker crafts a sort parameter containing a malicious SQL subquery, such as sort[nick,(SELECT(SLEEP(3)))]=ASC, which is passed unsanitized into the database query (FacturaScripts Advisory, Github Advisory).

Successful exploitation enables complete database disclosure through blind SQL injection techniques, allowing an attacker to extract user credentials and API keys, customer PII, financial records and transaction data, business intelligence and pricing information, and system configuration secrets. All API endpoints supporting sorting (e.g., /api/3/users, /api/3/customers, /api/3/attachedfiles) are affected, meaning any data accessible via the API is at risk. Organizations using FacturaScripts for integrations, mobile apps, or third-party connections are particularly exposed, as compromised API keys could enable further unauthorized access (FacturaScripts Advisory).

A detailed proof-of-concept (PoC) exploit, including a Python-based automated data exfiltration script, was published alongside the security advisory on February 3, 2026 (FacturaScripts Advisory). The exploit has also been indexed by Sploitus. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.029% (9th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Obtain API credentials: Log into the FacturaScripts web interface using valid credentials. Extract the CSRF token (multireqtoken) from the login page and authenticate via POST to /login. Navigate to /EditSettings?activetab=ListApiKey to retrieve an existing API key ID, then fetch the actual key string from /EditApiKey?code=<ID>.

2. Confirm vulnerability: Send a baseline request to a sortable API endpoint (e.g., GET /api/3/users?limit=1) with the X-Auth-Token header set to the retrieved API key and measure response time.

3. Inject time-based payload: Send a crafted request with a malicious sort parameter: GET /api/3/users?limit=1&sort[nick,(SELECT(SLEEP(3)))]=ASC. If the response is delayed by ~3 seconds compared to baseline, the system is confirmed vulnerable.

4. Automate data extraction: Use the published Python PoC script to perform character-by-character blind SQL injection. For each character position, inject a payload such as (SELECT IF(BINARY SUBSTRING((SELECT password FROM users WHERE nick='admin'),{i},1)='{char}',SLEEP(2),nick)) and infer the character based on response delay.

5. Exfiltrate target data: Repeat the extraction process for any desired SQL query (e.g., user password hashes, API keys, customer records) to achieve full database disclosure (FacturaScripts Advisory).

• Network: Unusual or repeated HTTP GET requests to API endpoints (e.g., /api/3/users, /api/3/customers) containing sort[ parameters with SQL syntax such as parentheses, SELECT, SLEEP, IF, or SUBSTRING in the query string; abnormally slow API responses (indicative of time-based injection delays).
• Logs: Web server access logs showing requests with URL-encoded SQL payloads in sort parameters (e.g., sort%5B...SELECT...SLEEP...%5D); repeated requests to the same endpoint with incrementally varying sort values (character-by-character extraction pattern).
• Authentication: Requests to /EditSettings?activetab=ListApiKey or /EditApiKey?code= from unexpected IP addresses or user agents, potentially indicating API key harvesting prior to exploitation (FacturaScripts Advisory).

Upgrade FacturaScripts to version 2025.81 or later, which addresses the vulnerability via commit 1b6cdfa9ee1bb3365ea4a4ad753452035a027605. The fix replaces the unsafe parenthesis-based bypass in DbQuery::orderBy() with strict allowlist validation (only LOWER(), UPPER(), and CAST() expressions are permitted), enforces ASC/DESC-only sort direction, and applies proper column escaping. As interim mitigations, restrict API access to trusted IP addresses, audit and rotate all API keys, and monitor API logs for anomalous sort parameter patterns. Applying the principle of least privilege to API user accounts is also recommended (Github Advisory, Patch Commit).

The vulnerability was reported by security researcher Łukasz Rybak and acknowledged by the FacturaScripts maintainer (NeoRazorX), who published the advisory and patch on February 3, 2026. The issue was indexed by multiple vulnerability tracking platforms including Vulners, VulDB, CIRCL, and INCIBE-CERT shortly after disclosure. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (FacturaScripts Advisory).