8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25513

CVE-2026-25513: FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25513

CVE-2026-25513:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	< 2025.81	2025.81

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in the ORDER BY clause of the FacturaScripts REST API, exploitable via the sort parameter. The analysis of the provided security advisory and the associated commit patch confirms the vulnerability in two main locations.

Modern Models (DbQuery::orderBy): The commit 1b6cdfa9ee1bb3365ea4a4ad753452035a027605 clearly shows the vulnerable code in Core/DbQuery.php. The orderBy function previously allowed any string containing parentheses to be directly included in the SQL query. The patch rectifies this by adding a whitelist validation for functions like LOWER(), UPPER(), and CAST().
Legacy Models (ModelClass::getOrderBy): The security advisory explicitly identifies Core/Model/Base/ModelClass.php and its getOrderBy method as vulnerable. It states that user-supplied sorting parameters are directly concatenated into the SQL query. The ModelClass::all method is the entry point that receives the malicious sort parameter from the API and passes it to getOrderBy.

The Proof of Concept demonstrates the vulnerability by injecting a SLEEP() function into the sort parameter's key, causing a time-based blind SQL injection. This confirms that the application fails to sanitize the keys of the sort array, which are then used to construct the ORDER BY clause.

Based on this evidence, the identified vulnerable functions are DbQuery::orderBy for modern models and ModelClass::getOrderBy (called by ModelClass::all) for legacy models. These functions would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.