CVE-2026-45262: Authenticated SQL Injection in FacturaScripts REST API via Where::sqlColumn Parenthesis Bypass

What the Vulnerability Is

CVE-2026-45262 is an authenticated SQL injection vulnerability (CWE-89) in the FacturaScripts REST API, rooted in the Where::sqlColumn method's handling of filter parameters. The method fails to properly sanitize column and operator tokens when parentheses are used to bypass its filter validation logic, allowing crafted filter[field][operator] query string parameters to inject arbitrary SQL. The advisory also flags CWE-918 (SSRF), noting that exploitation may extend beyond data exfiltration into request forgery via database-level functions such as LOAD_FILE or driver-level network calls — potentially enabling full compromise of the underlying database instance and lateral movement into internal network segments reachable from the database host.

Affected Software

• Product: facturascripts/facturascripts
• Vendor/Ecosystem: composer
• Affected versions: <= 2026.1
• CVSS: 9.9 (Critical)

Exploitation Status

Exploitation status is PoC-public: a public proof-of-concept exists, but there is no confirmed evidence of active in-the-wild exploitation or inclusion in CISA's KEV catalog at time of disclosure (2026-07-14). Defenders should treat this as an imminent threat — public PoC code substantially lowers the barrier to weaponization, and the requirement for only a valid low-privileged API key (rather than unauthenticated access) does not meaningfully reduce risk in environments where API keys are broadly provisioned or leaked.

How Our Detection Catches It

We ship coverage for this technique across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the detection logic focuses on REST API access log and web application log sources, looking for:

• Requests to FacturaScripts REST API endpoints containing filter[ query parameters with anomalous parenthesis usage in the field or operator position.
• Filter values consistent with SQL injection payload patterns (e.g., SQL keywords, comment sequences, or function calls like LOAD_FILE) embedded within otherwise well-formed filter tokens.
• Correlation of authenticated API key usage with a spike in malformed or injection-pattern filter requests from a single principal, which may indicate exploitation attempts rather than legitimate filtering.

This gives defenders visibility into exploitation attempts regardless of which SIEM stack they run, without requiring us to publish the exact query logic here.

Full Detection Details

For the complete KQL, SPL, and other platform-specific queries, along with recommended response actions, see the full detection page for CVE-2026-45262.