PT-2026-23701 · Unknown · Facturation System

Published 2026-03-06 · Updated 2026-03-06 · CVE-2018-25191

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Facturation System version 1.0

Description Facturation System version 1.0 contains an SQL injection issue that permits authenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the mod id parameter. Attackers can send POST requests to the ''editar producto.php'' endpoint with crafted SQL payloads in the mod id parameter to extract sensitive database information, including usernames, database names, and version details.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25191

Affected Products

Facturation System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25191 · Security Note
• https://exploit-db.com/exploits/45813 · Note
• https://t.me/CVEtracker/46606 · Telegram Post
• https://vulncheck.com/advisories/facturation-system-sql-injection-via-editar-productophp · Note