Executive brief
FrontAccounting, an open-source accounting system, contains a security flaw in its Audit Trail reporting feature. An authorized user with standard accounting permissions can execute unauthorized database commands. This could allow an attacker to steal sensitive financial data or crash the database by forcing it to perform extremely slow operations, potentially locking out all other users.
Technical details
A SQL injection vulnerability exists in FrontAccounting's Audit Trail report handler (reporting/rep710.php) due to improper sanitization of the PARAM_2 and PARAM_3 POST parameters. The PARAM_2 variable is concatenated into a SQL WHERE clause without integer casting or parameterization, while PARAM_3 is improperly handled in a string context. An authenticated attacker with SA_GLANALYTIC permissions can exploit this via UNION-based injection to extract data or time-based blind injection using SLEEP() functions. Notably, the SLEEP() function is amplified across JOIN result sets, allowing a single request to hold database connections open for extended periods, leading to connection exhaustion and denial of service. The issue is fixed in version 2.4.20 by implementing proper integer casting and database escaping.
Affected products
- FrontAccounting FrontAccounting < 2.4.20
Timeline
- 2026-04-28: patched: Release 2.4.20 published with security fixes.
- 2026-06-29: disclosed: Public disclosure of CVE-2026-40523.
References
- https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f
- https://jivasecurity.com/writeups/frontaccounting-sqli-audit-trail-report-cve-2026-40523
- https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/
- https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-reporting-rep710-php