Facturation System 1.0 is affected by a critical SQL injection vulnerability that allows authenticated attackers to extract sensitive database information.

The application is vulnerable to SQL injection (CWE-89) within the editar_producto.php endpoint. By sending a crafted POST request containing malicious SQL payloads in the mod_id parameter, an authenticated attacker can manipulate database queries to retrieve sensitive data such as usernames, database names, and version details.

The exploitation of this vulnerability poses a significant risk to data confidentiality. Unauthorized access to the database can lead to the exfiltration of sensitive administrative information, potentially compromising the integrity of the entire system. With a CVSS score of 7.1, this vulnerability is classified as high severity, reflecting the ease of exploitation and the potential for unauthorized data disclosure.

Immediate Action: As no official patch is currently available from the vendor, users should restrict access to the affected endpoint to trusted administrative users only or implement strict input validation on the mod_id parameter.

Proactive Monitoring: Security teams should monitor web server logs for anomalous POST requests to editar_producto.php, specifically searching for SQL syntax characters such as single quotes or UNION operators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the mod_id parameter.

Public Exploit Available: Yes, a published proof of concept exists, as documented in the Exploit-DB entry 45813.

Given the availability of a public proof of concept and the nature of SQL injection vulnerabilities, the risk of data exfiltration is substantial. Organizations utilizing Facturation System 1.0 must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, to prevent unauthorized access until a formal vendor patch is released or the software is migrated to a more secure platform.