Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-45262.
Upgrade to ProDetect FacturaScripts REST API Authenticated SQL Injection via Where::sqlColumn Parenthesis Bypass (CVE-2026-45262) in Sumo Logic CSE
FacturaScripts prior to and including version 2026.1 contains an authenticated SQL injection vulnerability in the REST API 'filter' parameter. The Where::sqlColumn method fails to properly sanitize column/operator tokens when parentheses are used to bypass filter validation, allowing an authenticated low-privileged API user (with a valid API key) to inject arbitrary SQL via crafted filter[field][operator] query string parameters. Given CVSS 9.9 and CWE-918 (SSRF) alongside CWE-89, exploitation may extend beyond data exfiltration into internal request forgery via database-level functions (e.g., LOAD_FILE, or DB-driver network calls), enabling full compromise of the underlying MySQL/MariaDB/PostgreSQL instance and lateral movement into internal network segments reachable from the database host.
MITRE ATT&CK
- Tactic
- Initial Access Collection Exfiltration
Sumo Detection Query
_sourceCategory=Web/Access
| where uri_path matches "*\/api\/*"
| where uri_query matches "*filter*"
| urldecode(uri_query) as decoded_query
| where decoded_query matches "*))*" or decoded_query matches "*UNION*SELECT*" or decoded_query matches "*SLEEP(*" or decoded_query matches "*BENCHMARK(*"
| count by clientip, uri_path, decoded_query
| sort -_countAggregates FacturaScripts API access log events where filter parameters exhibit SQL injection/parenthesis-bypass syntax.
Data Sources
Required Tables
False Positives & Tuning
- Nested legitimate filter expressions from front-end clients
- Repeated scanner traffic from authorized assessments
- Load-testing tools sending crafted query strings
Other platforms for CVE-2026-45262
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Parenthesis-Bypass Filter SQLi Probe
Expected signal: HTTP access log entry showing the encoded filter parameter with '))' and 'OR 1=1--' tokens against the /api/3/clientes endpoint.
- Test 2Simulate UNION SELECT Injection via Filter Parameter
Expected signal: Web access log and database general_log entries showing a UNION SELECT statement referencing fs_users table.
- Test 3Simulate Time-Based Blind SQLi via SLEEP()
Expected signal: Observable response delay (~5s) in HTTP access logs plus SLEEP( token present in the decoded filter query string.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-45262 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month