FacturaScripts EUVD-2026-32630

Exploitation requires all of the following conditions: (1) Authenticated user account with write access to Warehouse → Products module (typically warehouse manager or admin role); (2) Ability to create or edit product records and save the 'reference' field with arbitrary content including quotes and plus signs; (3) Target user (victim) must have access to Sales → Invoices, Purchases, or Delivery Notes features and must manually open the product search modal and click on the malicious product row; (4) victim's browser must execute JavaScript from the application domain (default for any modern browser); (5) the affected PHP files (SalesModalHTML.php, PurchasesModalHTML.php) must be in use, meaning the sales/purchases search modal functionality must be enabled. The vulnerability does NOT require: special network configuration, disabled security headers, or non-default product settings. However, it is limited to authenticated attackers (PR:L in CVSS) and requires user interaction from the victim (UI:R), making it unsuitable for automated mass exploitation but well-suited for targeted privilege escalation within an organization.

CVSS 5.4 (Network, Low Complexity, Low privilege required, User interaction required, Changed scope, Low confidentiality and integrity impact) combined with confirmed POC steps and detailed reproduction instructions indicates moderate real-world risk. The requirement for authenticated user with warehouse write access and user interaction (victim must open search modal and click product) significantly limits automated exploitation compared to unauthenticated vulnerabilities. However, the practical impact is amplified by privilege escalation potential: a low-privilege warehouse employee can execute code in an administrator's authenticated session, potentially creating new admin accounts or exfiltrating sensitive business data. The absence of any vendor-released patch (vulnerable in 2025.92 with no fixed version identified) is a critical gap that elevates urgency despite the moderate CVSS score. Session cookies are HttpOnly-protected, preventing direct session hijacking via document.cookie, but this does not limit the attacker's ability to make authenticated requests on behalf of the victim. The actual exploitability depends on whether administrators regularly use the product search feature in invoices and whether warehouse staff have legitimate but limited access-a common configuration in multi-user accounting systems. No evidence of active exploitation in the wild at time of analysis.

An employee with warehouse product management access (common in multi-user accounting systems) creates a product with reference set to x'+alert(1)+' and saves it. Days later, when a company administrator opens an invoice to process an order, clicks the product search modal button, and clicks the malicious product row in the search results, the JavaScript payload executes in the admin's authenticated browser context. The attacker's script can immediately POST to /EditUser to create a new administrator account, exfiltrate customer or financial data from the DOM, or redirect the admin to a phishing page. The attack succeeds because the admin user never triggered the vulnerability directly-the warehouse employee planted it weeks earlier in static database content.