FacturaScripts is an open‑source ERP system that includes a REST API where users can specify sorting of results. The vulnerability occurs in the ModelClass::getOrderBy() method, where the value supplied via the sort parameter is concatenated directly into the SQL ORDER BY clause without validation or sanitization. Because the API requires authentication, any authenticated user can supply a crafted sort string that injects arbitrary SQL. This enables execution of any SQL statement on the underlying database, giving full read/write/DDL capabilities and potentially exposing sensitive organizational data, destroying data, or disabling the application. This is a classic SQL injection (CWE‑89) compounded by disallowed input validation (CWE‑20) and unsafe use of user‑supplied sort fields (CWE‑1286).

Affected vendors and products include NeoRazorX:FacturaScripts. All versions of FacturaScripts prior to 2025.81 are vulnerable, since the patch that addressed the issue was released with version 2025.81. The issue manifests in any API endpoint that accepts a sort parameter, so any installation using the REST API for sorted data retrieval is impacted.

With a CVSS score of 8.3, the vulnerability carries high severity, granting attackers direct control over the database through the application. The EPSS score is below 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated API user; therefore, attackers must first gain legitimate or compromised API credentials. If attackers obtain such credentials, they could execute arbitrary SQL queries, leading to data breach, corruption, or denial of service. The limited attack surface (authenticated API) and low EPSS reduce overall risk, but the potential impact remains significant.