FacturaScripts 2025.43 - XSS

ExploitDBExploitDB exploitExploitEDB-52517

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a complete stored XSS exploit against FacturaScripts 2025.43. It includes a crafted XML payload with multiple XSS vectors (namespace-wrapped script tags and CDATA-embedded script) and step-by-step instructions for uploading the file as an authenticated user, then triggering execution when an administrator accesses the file.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard proof-of-concept exploit description for CVE-2025-69210, a stored XSS vulnerability in FacturaScripts. It contains only documentation, reproduction steps, and example payloads that demonstrate the claimed XSS behavior (alert and redirect). No concealed executable behavior, persistence, credential theft, or unrelated remote access is present. The payloads are inline and consistent with the disclosed vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesHTMLXMLJavaScript
Target softwareFacturaScripts
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable exploit code: a complete XML payload with multiple XSS vectors (lines 53-91) and a full HTTP request template (lines 45-93) that, when sent by an authenticated attacker, stores the payload. The instructions describe triggering execution by accessing the uploaded file (lines 97-100), which constitutes exploitation, not mere detection.

exploits/multiple/webapps/52517.txt:53-91exploits/multiple/webapps/52517.txt:45-93exploits/multiple/webapps/52517.txt:97-100

Requirements

  • Authenticated access as a normal user to FacturaScripts instanceexploits/multiple/webapps/52517.txt:28
  • Ability to upload files to a product (or intercept and modify upload request)exploits/multiple/webapps/52517.txt:40-42
  • Victim (e.g., administrator) must access the uploaded XML file via the generated URLexploits/multiple/webapps/52517.txt:97-100

Observed behavior

  • Uploads a crafted XML file containing multiple XSS payloads (namespace-wrapped script tags and CDATA-embedded script) via a multipart POST requestexploits/multiple/webapps/52517.txt:45-93
  • When the uploaded file is accessed, the browser executes the embedded JavaScript, displaying an alert('XSS') and optionally redirecting to an attacker-controlled domainexploits/multiple/webapps/52517.txt:56-68exploits/multiple/webapps/52517.txt:74-79exploits/multiple/webapps/52517.txt:103-105
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://evil.comExample attacker-controlled domain used in XSS payload redirect demonstrations.exploits/multiple/webapps/52517.txt:60exploits/multiple/webapps/52517.txt:67exploits/multiple/webapps/52517.txt:77
Url
http://google.comExample benign URL used in the XML payload's info section.exploits/multiple/webapps/52517.txt:87
Review boundaries

What the analysis did not establish

  • Evidence is limited to the single text file from ExploitDB; no external tools, libraries, or referenced resources were analyzed.
  • The artifact includes an HTTP request template with placeholder cookies; actual exploitation requires valid authenticated session cookies.
  • The artifact does not include a fully automated script; the exploit steps require manual interaction or adaptation.
  • Only the readable text of the exploit file was reviewed; no binary files or external resources were inspected.
  • The review does not verify the exploit works or assess the safety of the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1