{"id":"GHSA-vrxf-vrc4-22p7","summary":"FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint","details":"### Summary\nAn unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated.\n\n### Details\nThe phpinfo() debug endpoint was intentionally added in commit 8c31c106  (\"Added phpinfo option to the installer\") on February 27, 2018, and has remained in the codebase for over 8 years across multiple major versions.\n\nThe feature appears to have been added as a convenience tool to help users diagnose PHP configuration during installation. However, it exposes sensitive server information to any unauthenticated attacker who knows the parameter.\n\nVulnerable code (Core/Controller/Installer.php ~line 115):\n\n    if ('TRUE' === $this-\u003erequest-\u003equery('phpinfo', '')) {\n        phpinfo();\n        return;\n    }\n\nThis vulnerability is of the same class as CVE-2025-34081 (CONPROSYS HMI System unauthenticated phpinfo() exposure), which received a CVE assignment.\n\nIntroduced: commit 8c31c1060581ad6ad591c7689da3a8df8a29f486 (Feb 27 2018)\nStill present: v2026-39-g262e79208 (confirmed April 2026)\n\n### PoC\nPrerequisites: Fresh FacturaScripts deployment where installation has not yet been completed (config.php does not contain db_name).\n\nStep 1 — Clone and serve the application:\n    git clone https://github.com/NeoRazorX/facturascripts\n    cd facturascripts\n    php -S localhost:8000\n\nStep 2 — Send the following unauthenticated GET request:\n    GET /?phpinfo=TRUE HTTP/1.1\n    Host: localhost:8000\n\nStep 3 — Observe full phpinfo() output returned (20+ pages) containing:\n    - Complete PHP configuration\n    - All server environment variables\n    - Filesystem paths\n    - Loaded extensions and versions\n    - HTTP request headers\n\nNo credentials, cookies, or prior interaction required.\n\nTested on: PHP 8.1.34, macOS, fresh clone with no configuration applied.\nProof of concept screenshot/PDF available.\n\n### Impact\nVulnerability type: Unauthenticated Information Disclosure (CWE-200)\n\nAny unauthenticated remote attacker who can reach a freshly deployed FacturaScripts instance before installation is completed can retrieve the full PHP environment. On production deployments this includes:\n\n  - Database credentials (DB_PASSWORD, DB_USER) if set as environment variables\n  - Application secrets (APP_KEY, JWT secrets) if set as environment variables  \n  - Cloud provider credentials (AWS_SECRET_ACCESS_KEY, etc.) if present\n  - Full server filesystem paths enabling targeted path traversal attempts\n  - Exact PHP version and loaded extensions enabling version-specific attacks\n  - All HTTP headers revealing internal infrastructure details\n  - Database connection configuration (mysqli default socket, PDO drivers)\n  - Exact PHP version enabling version-specific CVE targeting (PHP 8.1.34)\n\nFresh deployments are commonly left unconfigured for extended periods on shared hosting and cloud environments, making this window reliably exploitable in real-world scenarios.\n\nFix: Remove lines 115-118 from Core/Controller/Installer.php:\n\n    if ('TRUE' === $this-\u003erequest-\u003equery('phpinfo', '')) {\n        phpinfo();\n        return;\n    }","aliases":["CVE-2026-42878"],"modified":"2026-09-10T03:51:07.034816113Z","published":"2026-05-07T19:43:24Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-05-07T19:43:24Z","nvd_published_at":"2026-05-27T19:16:17Z","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42878"},{"type":"PACKAGE","url":"https://github.com/NeoRazorX/facturascripts"}],"affected":[{"package":{"name":"facturascripts/facturascripts","ecosystem":"Packagist","purl":"pkg:composer/facturascripts/facturascripts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2026"},{"last_affected":"2026.1"}]}],"versions":["v2026","v2026.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vrxf-vrc4-22p7/GHSA-vrxf-vrc4-22p7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}