«Live PoC verified 2026-04-30 against a stock FacturaScripts master at "127.0.0.1:8081". A scoped "ApiKey" with "fullaccess=0" and an "ApiAccess" row granting "allowget=1" on the "clientes" resource only (no other rights, no UI session, no admin) issued one "GET /api/3/clientes?filter[(0)UNION%20SELECT%20...]=" request and the response body contained the raw bcrypt hash of the admin user's password ("$2y$12$sLfA/XCqnjqLmYJwK.2V7eUHrHTHcQfkTYYfs1.lxX3OHrsmmkMGO") and the admin's "logkey" cookie value. The leaked "logkey" was injected into a fresh cookie jar and "GET /AdminPlugins" returned 200 with the admin plugin management UI. End-to-end account takeover from a read-only token with no CSRF, no second factor, no rate-limit interaction beyond the default 5-incident IP throttle.» "Core/Where.php::sqlColumn()" exempts any field name that contains both "(" and ")" from identifier escaping. The two API filter builders ("APIModel::getWhereValues" and "ApiAttachedFiles::getWhereValues") feed the raw request key ("$_GET['filter'][$key]") straight into "new DataBaseWhere($key, $value, '=', ...)". When the model's "all()" reaches "Where::multiSqlLegacy" -> "Where::sql()" -> "Where::sqlColumn($key)", the parenthesis branch returns the attacker-controlled string unmodified. The string is concatenated into "WHERE <attacker> = '<value>'", which an attacker can pivot to "WHERE (0)UNION SELECT ... FROM users WHERE(nick='admin')-- = 'value'", leaking arbitrary columns from any table.