Enumeration of Unauthenticated Users in FacturaScripts

Executive Summary

This vulnerability in FacturaScripts version 2025.61 allows unauthenticated users to enumerate valid usernames. The application responds differently to login attempts with valid versus invalid usernames, enabling attackers to systematically identify real accounts by analyzing response variations such as time delays, error messages, or HTTP status codes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor login response times, error messages, and HTTP status codes for inconsistencies when testing valid and invalid usernames. Use tools like curl or Burp Suite to send repeated login requests and compare responses.

Useful 0 Not Useful 0

Impact Analysis

An attacker could compile a list of valid user accounts and use it for brute-force attacks, password spraying, credential stuffing, or social engineering. This increases the risk of unauthorized access to sensitive data or system functions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance breaches, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Implement account lockout policies after failed login attempts, enforce strong password requirements, and enable multi-factor authentication. Additionally, review and update error messages to avoid revealing valid usernames.

Useful 0 Not Useful 0