8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25514

CVE-2026-25514: FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25514

CVE-2026-25514:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	< 2025.81	2025.81

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic SQL injection within the CodeModel::all method of FacturaScripts. The root cause is the direct concatenation of user-controlled input into an SQL query string without proper sanitization or the use of prepared statements. The vulnerable parameters source, fieldcode, and fieldtitle from the autocomplete functionality map to $tableName, $fieldCode, and $fieldDescription respectively in the CodeModel::all function. This allows an authenticated attacker to inject arbitrary SQL and exfiltrate data from the database.

The patch 5c070f82665b98efd2f914a4769c6dc9415f5b0f confirms this analysis. It introduces two main changes:

In Core/Model/CodeModel.php, the all() and get() methods are modified to validate the $fieldCode and $fieldDescription parameters using a new isValidFieldName function. This prevents arbitrary SQL from being injected into the column name part of the query.
In Core/Controller/CopyModel.php, the autocompleteAction() method is updated to include a whitelist check on the source parameter, which is used as the table name. This restricts which tables can be queried, mitigating the injection vector for the table name.

Therefore, a runtime profile during exploitation would show a call stack originating from CopyModel::autocompleteAction, which then calls CodeModel::search and finally the vulnerable CodeModel::all function where the malicious SQL is executed. The CodeModel::get function was also identified as vulnerable due to the similar patch applied to it.

Vulnerable functions

CodeModel::all

Core/Model/CodeModel.php

This function is vulnerable to SQL injection because it directly concatenates user-supplied parameters (`$tableName`, `$fieldCode`, `$fieldDescription`) into an SQL query without proper sanitization or parameterized binding. The patch introduces validation for `$fieldCode` and `$fieldDescription` using `isValidFieldName` to mitigate this.

CodeModel::get

Core/Model/CodeModel.php

Similar to the `all` method, the `get` method was patched to validate the `$fieldCode` and `$fieldDescription` parameters. This indicates that it was also vulnerable to SQL injection by allowing unsanitized user input to be part of an SQL query.

CopyModel::autocompleteAction

Core/Controller/CopyModel.php

This function serves as an entry point for the SQL injection vulnerability. It handles the 'autocomplete' action and passes user-controlled data from the request, including the 'source' (table name), 'fieldcode', and 'fieldtitle', to the vulnerable `CodeModel::search` method, which in turn calls `CodeModel::all`. The patch mitigates this by restricting the 'source' parameter to a list of allowed values.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.