GHSA-g6w2-q45f-xrp4: FacturaScripts is Vulnerable to Reflected XSS
Reflected XSS via SQL Error MessagesSummaryA reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's `| raw` filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization.Attackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form).**CVSS 6.1 (Medium-High)**What was FoundWhere the bug exists in the code:`Core/View/Macro/Utils.html.twig`, line 27:That `| raw` is the problem. It tells Twig not to escape anything.How it worksSo here's what happens:Hhit `/EditProducto?code=<svg onload=alert(1)> or <img src=x onerror=alert(1)>`The app tries to look up a product with that "code"PostgreSQL throws an error because `<svg onload=alert(1)>` isn't a valid integerThe error goes something like:   ```
ERROR: invalid input syntax for type integer: "<svg onload=alert(1)>"
LINE 1: SELECT * FROM "productos" WHERE "idproducto" = '<img src=x onerror=alert(1)>"This gets logged via MiniLog and displayed to the userBecause of `| raw`, the browser actually executes the JSThe error logging happens in `Core/Base/DataBase.php` around line 236:And PostgreSQL's error message includes whatever garbage it was sent.Reproduction StepsRequirementsWorking FacturaScripts installAny user account (doesn't need to be admin)The victim needs to be logged inQuick testJust visit this URL while logged in:An alert box should  pop up.For a real attack (credential phishing)Set up a simple server to catch credentials:Then craft a URL that injects a fake login form:Send that to someone (email, chat, whatever). When they click it and enter their password thinking their session expired, their creds are displayed.Other endpoints that workPretty much anything that uses the `code` parameter:`/EditProducto?code=``/EditCliente?code=``/EditFacturaCliente?code=``/EditProveedor?code=`etc.Basically all the Edit controllers.ImpactWhat attackers can do with this**Steal credentials** - Can't grab cookies directly (HttpOnly), but the phishing form trick works great. Victim thinks their session timed out and re-enters their password.**Read page data** - Once JS is running, attackers can scrape whatever's on the page (invoices, customer info, financial data) and send it somewhere.**Keylog** - Inject a keylogger that captures everything they type.**Bypass CSRF** - Grab the `multireqtoken` from the page and make requests as the victim.What attackers CAN'T doCan't steal session cookies via `document.cookie` - they're HttpOnly.Business sideThis is a financial app, so if attackers compromise an admin account, the following is possible to create or expose:Fake invoicesRedirected paymentsCustomer data breach (GDPR stuff)The usual messFixQuick fixJust remove `| raw` from line 27 in `Core/View/Macro/Utils.html.twig`:That's it. Twig escapes by default, so removing `| raw` fixes the XSS.If projects want to be thoroughSanitize messages before they go into the log:Add CSP headers to block inline scripts as a backupMaybe validate the `code` parameter format before it hits the databaseResourceshttps://cwe.mitre.org/data/definitions/79.htmlhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html**Found:** Dec 31, 2025  
**Tested on:** FacturaScripts 2025.61 (Docker), verified vulnerable in 2025.71 (GitHub latest)
<img width="1917" height="868" alt="1" src="https://github.com/user-attachments/assets/a7d770c8-1d61-499c-83dc-e21be8e61c87" />
<img width="337" height="130" alt="3" src="https://github.com/user-attachments/assets/463067ee-3a73-45ed-af26-c32264d5bf41" />
<img width="1915" height="870" alt="phising" src="https://github.com/user-attachments/assets/6e15a021-dc5f-4708-bdd1-887ecb2d2ffb" />
<img width="1915" height="862" alt="phising2" src="https://github.com/user-attachments/assets/100a63b6-c066-43d5-ab39-6085f51ba282" />
<img width="1918" height="877" alt="sql erroe" src="https://github.com/user-attachments/assets/4c3182ba-380d-44d4-ab34-4b0840ad3e39" />
<img width="1165" height="277" alt="version" src="https://github.com/user-attachments/assets/5f23e4de-cf03-4fcf-a6c5-6ca327c8c43a" />
CVSS v3.1: 5.4