Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-45262.
Upgrade to ProDetect FacturaScripts REST API Authenticated SQL Injection via Where::sqlColumn Parenthesis Bypass (CVE-2026-45262) in Elastic Security
FacturaScripts prior to and including version 2026.1 contains an authenticated SQL injection vulnerability in the REST API 'filter' parameter. The Where::sqlColumn method fails to properly sanitize column/operator tokens when parentheses are used to bypass filter validation, allowing an authenticated low-privileged API user (with a valid API key) to inject arbitrary SQL via crafted filter[field][operator] query string parameters. Given CVSS 9.9 and CWE-918 (SSRF) alongside CWE-89, exploitation may extend beyond data exfiltration into internal request forgery via database-level functions (e.g., LOAD_FILE, or DB-driver network calls), enabling full compromise of the underlying MySQL/MariaDB/PostgreSQL instance and lateral movement into internal network segments reachable from the database host.
MITRE ATT&CK
- Tactic
- Initial Access Collection Exfiltration
Elastic Detection Query
any where event.dataset == "nginx.access" and
url.path : "*/api/*" and
url.query : "*filter*" and
(url.query : "*))*" or url.query : "*((*" or url.query : "*UNION*SELECT*" or url.query : "*SLEEP(*" or url.query : "*BENCHMARK(*")Detects HTTP requests to the FacturaScripts REST API with filter parameters containing SQL injection or parenthesis-bypass indicators.
Data Sources
Required Tables
False Positives & Tuning
- Complex legitimate filter grouping using nested parentheses
- Internal monitoring tools polling the API with test filter values
- Authorized security assessments of the API
Other platforms for CVE-2026-45262
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Parenthesis-Bypass Filter SQLi Probe
Expected signal: HTTP access log entry showing the encoded filter parameter with '))' and 'OR 1=1--' tokens against the /api/3/clientes endpoint.
- Test 2Simulate UNION SELECT Injection via Filter Parameter
Expected signal: Web access log and database general_log entries showing a UNION SELECT statement referencing fs_users table.
- Test 3Simulate Time-Based Blind SQLi via SLEEP()
Expected signal: Observable response delay (~5s) in HTTP access logs plus SLEEP( token present in the decoded filter query string.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-45262 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month