FacturaScripts, an open source accounting solution, contains an unauthenticated vulnerability in its Installer controller that triggers a phpinfo() call when a remote attacker requests the URL path with the parameter ?phpinfo=TRUE. The resulting output exposes the full PHP configuration, server environment variables, file system paths, and loaded extensions. This disclosure can reveal database credentials, API keys, or other application secrets stored as environment variables, posing a significant confidentiality risk. The weakness is classified as CWE‑200: Information Exposure.

The issue affects installations of FacturaScripts provided by NeoRazorX that run any version prior to v2026. In those deployments, the Installer controller is reachable by default and vulnerable to this parameter. Version v2026 and later include the fix that removes the ability to trigger phpinfo() through the installer.

The CVSS score of 5.3 indicates a moderate severity, and while EPSS data is unavailable, the lack of CISA KEV listing suggests no large‐scale exploitation has been observed to date. Attackers only need to send an unauthenticated HTTP GET request to the affected endpoint, which is commonly accessible over the Internet. Given the ease of exploitation and potential exposure of sensitive configuration data, the risk to affected systems remains high if unpatched.