{"id":"CVE-2026-42878","aliases":["GHSA-vrxf-vrc4-22p7"],"url":"https://o3.security/vulnerability/CVE-2026-42878","summary":"FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts","details":"### Summary\nAn unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated.\n\n### Details\nThe phpinfo() debug endpoint was intentionally added in commit 8c31c106  (\"Added phpinfo option to the installer\") on February 27, 2018, and has remained in the codebase for over 8 years across multiple major versions.\n\nThe feature appears to have been added as a convenience tool to help users diagnose PHP configuration during installation. However, it exposes sensitive server information to any unauthenticated attacker who knows the parameter.\n\nVulnerable code (Core/Controller/Installer.php ~line 115):\n\n    if ('TRUE' === $this->request->query('phpinfo', '')) {\n        phpinfo();\n        return;\n    }\n\nThis vulnerability is of the same class as CVE-2025-34081 (CONPROSYS HMI System unauthenticated phpinfo() exposure), which received a CVE assignment.\n\nIntroduced: commit 8c31c1060581ad6ad591c7689da3a8df8a29f486 (Feb 27 2018)\nStill present: v2026-39-g262e79208 (confirmed April 2026)\n\n### PoC\nPrerequisites: Fresh FacturaScripts deployment where installation has not yet been completed (config.php does not contain db_name).\n\nStep 1 — Clone and serve the application:\n    git clone https://github.com/NeoRazorX/facturascripts\n    cd facturascripts\n    php -S localhost:8000\n\nStep 2 — Send the following unauthenticated GET request:\n    GET /?phpinfo=TRUE HTTP/1.1\n    Host: localhost:8000\n\nStep 3 — Observe full phpinfo() output returned (20+ pages) containing:\n    - Complete PHP configuration\n    - All server environment variables\n    - Filesystem paths\n    - Loaded extensions and versions\n    - HTTP request headers\n\nNo credentials, cookies, or prior interaction required.\n\nTested on: PHP 8.1.34, macOS, fresh clone with no configuration applied.\nProof of concept screenshot/PDF available.\n\n### Impact\nVulnerability type: Unauthenticated Information Disclosure (CWE-200)\n\nAny unauthenticated remote attacker who can reach a freshly deployed FacturaScripts instance before installation is completed can retrieve the full PHP environment. On production deployments this includes:\n\n  - Database credentials (DB_PASSWORD, DB_USER) if set as environment variables\n  - Application secrets (APP_KEY, JWT secrets) if set as environment variables  \n  - Cloud provider credentials (AWS_SECRET_ACCESS_KEY, etc.) if present\n  - Full server filesystem paths enabling targeted path traversal attempts\n  - Exact PHP version and loaded extensions enabling version-specific attacks\n  - All HTTP headers revealing internal infrastructure details\n  - Database connection configuration (mysqli default socket, PDO drivers)\n  - Exact PHP version enabling version-specific CVE targeting (PHP 8.1.34)\n\nFresh deployments are commonly left unconfigured for extended periods on shared hosting and cloud environments, making this window reliably exploitable in real-world scenarios.\n\nFix: Remove lines 115-118 from Core/Controller/Installer.php:\n\n    if ('TRUE' === $this->request->query('phpinfo', '')) {\n        phpinfo();\n        return;\n    }","published":"2026-05-27T18:28:05.666Z","modified":"2026-08-12T03:51:41.291008182Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.0024,"percentile":0.15283,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"facturascripts/facturascripts","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42878.json"},{"type":"ADVISORY","url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42878"},{"type":"PACKAGE","url":"https://github.com/NeoRazorX/facturascripts"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:41.291008182Z"}}