FacturaScripts REST API Authenticated SQL Injection via Where::sqlColumn Parenthesis Bypass (CVE-2026-45262)

let SuspiciousPatterns = dynamic(["'", "--", "/*", "UNION", "SELECT", "OR 1=1", "))", "((", "SLEEP(", "BENCHMARK("]);
AppServiceHTTPLogs
| where CsUriStem has "/api/" and CsUriStem has_any ("facturascripts", "3/")
| where CsUriQuery has "filter"
| extend DecodedQuery = url_decode(CsUriQuery)
| where DecodedQuery matches regex @"filter\[[a-zA-Z0-9_]+\]\[[a-zA-Z0-9_]*\)\(" or DecodedQuery has_any (SuspiciousPatterns)
| project TimeGenerated, CIp, CsMethod, CsUriStem, DecodedQuery, ScStatus
| order by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=nginx:access uri_path="*/api/*"
| where match(uri_query, "filter\[[a-zA-Z0-9_]+\]")
| eval decoded_query=urldecode(uri_query)
| regex decoded_query="(?i)(\)\(|UNION\s+SELECT|SLEEP\(|BENCHMARK\(|OR\s+1=1|--\s|/\*)"
| table _time, clientip, method, uri_path, decoded_query, status
| sort -_time

any where event.dataset == "nginx.access" and
  url.path : "*/api/*" and
  url.query : "*filter*" and
  (url.query : "*))*" or url.query : "*((*" or url.query : "*UNION*SELECT*" or url.query : "*SLEEP(*" or url.query : "*BENCHMARK(*")

SELECT DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, "URL", "HTTP Query String"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND "URL" ILIKE '%/api/%'
AND ("HTTP Query String" ILIKE '%filter%))%' OR "HTTP Query String" ILIKE '%UNION%SELECT%' OR "HTTP Query String" ILIKE '%SLEEP(%' OR "HTTP Query String" ILIKE '%BENCHMARK(%')
LAST 24 HOURS

_sourceCategory=Web/Access
| where uri_path matches "*\/api\/*"
| where uri_query matches "*filter*"
| urldecode(uri_query) as decoded_query
| where decoded_query matches "*))*" or decoded_query matches "*UNION*SELECT*" or decoded_query matches "*SLEEP(*" or decoded_query matches "*BENCHMARK(*"
| count by clientip, uri_path, decoded_query
| sort -_count

rule facturascripts_sqli_cve_2026_45262 {
  meta:
    description = "Detects FacturaScripts REST API filter parameter SQL injection (CVE-2026-45262)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*\/api\/.*filter.*/
    re.regex($e.target.url, `(\)\(|UNION\s+SELECT|SLEEP\(|BENCHMARK\()`)
  condition:
    $e
}

#event_simpleName=HttpRequestEvent
| RequestURI="*\/api\/*"
| RequestURI="*filter*"
| decoded:=urlDecode(RequestURI)
| in(field=decoded, values=["*))*", "*UNION*SELECT*", "*SLEEP(*", "*BENCHMARK(*"], ignoreCase=true)
| table([timestamp, ClientIP, RequestURI, decoded])