CVE-2026-42878: Facturascripts/facturascripts FacturaScripts Vulnerable To Unauthenticated Phpinfo() Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vrxf-vrc4-22p7",
  "modified" : "2026-06-08T23:53:21Z",
  "published" : "2026-05-07T19:43:24Z",
  "aliases" : [ "CVE-2026-42878" ],
  "summary" : "FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint",
  "details" : "### Summary\nAn unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated.\n\n### Details\nThe phpinfo() debug endpoint was intentionally added in commit 8c31c106  (\"Added phpinfo option to the installer\") on February 27, 2018, and has remained in the codebase for over 8 years across multiple major versions.\n\nThe feature appears to have been added as a convenience tool to help users diagnose PHP configuration during installation. However, it exposes sensitive server information to any unauthenticated attacker who knows the parameter.\n\nVulnerable code (Core/Controller/Installer.php ~line 115):\n\n    if ('TRUE' === $this->request->query('phpinfo', '')) {\n        phpinfo();\n        return;\n    }\n\nThis vulnerability is of the same class as CVE-2025-34081 (CONPROSYS HMI System unauthenticated phpinfo() exposure), which received a CVE assignment.\n\nIntroduced: commit 8c31c1060581ad6ad591c7689da3a8df8a29f486 (Feb 27 2018)\nStill present: v2026-39-g262e79208 (confirmed April 2026)\n\n### PoC\nPrerequisites: Fresh FacturaScripts deployment where installation has not yet been completed (config.php does not contain db_name).\n\nStep 1 — Clone and serve the application:\n    git clone https://github.com/NeoRazorX/facturascripts\n    cd facturascripts\n    php -S localhost:8000\n\nStep 2 — Send the following unauthenticated GET request:\n    GET /?phpinfo=TRUE HTTP/1.1\n    Host: localhost:8000\n\nStep 3 — Observe full phpinfo() output returned (20+ pages) containing:\n    - Complete PHP configuration\n    - All server environment variables\n    - Filesystem paths\n    - Loaded extensions and versions\n    - HTTP request headers\n\nNo credentials, cookies, or prior interaction required.\n\nTested on: PHP 8.1.34, macOS, fresh clone with no configuration applied.\nProof of concept screenshot/PDF available.\n\n### Impact\nVulnerability type: Unauthenticated Information Disclosure (CWE-200)\n\nAny unauthenticated remote attacker who can reach a freshly deployed FacturaScripts instance before installation is completed can retrieve the full PHP environment. On production deployments this includes:\n\n  - Database credentials (DB_PASSWORD, DB_USER) if set as environment variables\n  - Application secrets (APP_KEY, JWT secrets) if set as environment variables  \n  - Cloud provider credentials (AWS_SECRET_ACCESS_KEY, etc.) if present\n  - Full server filesystem paths enabling targeted path traversal attempts\n  - Exact PHP version and loaded extensions enabling version-specific attacks\n  - All HTTP headers revealing internal infrastructure details\n  - Database connection configuration (mysqli default socket, PDO drivers)\n  - Exact PHP version enabling version-specific CVE targeting (PHP 8.1.34)\n\nFresh deployments are commonly left unconfigured for extended periods on shared hosting and cloud environments, making this window reliably exploitable in real-world scenarios.\n\nFix: Remove lines 115-118 from Core/Controller/Installer.php:\n\n    if ('TRUE' === $this->request->query('phpinfo', '')) {\n        phpinfo();\n        return;\n    }",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "facturascripts/facturascripts"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2026"
      }, {
        "last_affected" : "2026.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42878"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/NeoRazorX/facturascripts"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-07T19:43:24Z",
    "nvd_published_at" : "2026-05-27T19:16:17Z"
  }
}