# CVE-2026-40524: FrontAccounting SQL injection in get_gl_transactions

Source: https://junglewise.ai/threats/cve-2026-40524-frontaccounting-sql-injection-in-get-gl-transactions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-40524 · Severity: high · CVSS 8.1 · Published 2026-06-29

FrontAccounting, an open-source enterprise resource planning (ERP) system, contains a security flaw in its reporting module. An attacker with basic reporting permissions can manipulate database queries to bypass security filters and extract sensitive financial data, such as journal entries and password hashes. This could lead to a significant breach of corporate financial records and unauthorized access to administrative accounts.

Technologies: [FrontAccounting](https://junglewise.ai/threats/technologies/frontaccounting). Vendors: [FrontAccounting](https://junglewise.ai/threats/vendors/frontaccounting).

## Quick answers

**Is CVE-2026-40524 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40524 being exploited in the wild.

**How severe is CVE-2026-40524?** High severity, with a CVSS score of 8.1, published 29 June 2026.

**Which products and versions are affected?** FrontAccounting < 2.4.20.

**Is there a fix for CVE-2026-40524?** A patch was published on 2026-04-28: Release 2.4.20 published with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40524 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40524?** Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in FrontAccounting versions prior to 2.4.20 within the get_gl_transactions() function located in gl/includes/db/gl_db_trans.inc. The root cause is the direct concatenation of the $filter_type parameter (sourced from $_POST['PARAM_2'] in rep702.php) into a SQL IN() clause without parameterization or escaping. An authenticated attacker with SA_GLANALYTIC permissions can break out of the IN() clause using a closing parenthesis and inject arbitrary SQL conditions. Because the application returns a PDF report, attackers can use a boolean-based blind technique by observing the significant response size differential between 'true' (full report) and 'false' (empty report) conditions to exfiltrate data. The vulnerability is patched in version 2.4.20 by implementing db_escape() on the affected parameter.

## Affected products

- FrontAccounting FrontAccounting < 2.4.20

## Timeline

- 2026-04-28: patched: Release 2.4.20 published with security fixes
- 2026-06-29: disclosed: Public disclosure and CVE assignment

## References

- [https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f](https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f)
- [https://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524](https://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524)
- [https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/](https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/)
- [https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions](https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions)

## Related threats

- [FrontAccounting weak password hashing with unsalted MD5](https://junglewise.ai/threats/cve-2026-80211-frontaccounting-weak-password-hashing-with-unsalted-md5)
- [FrontAccounting CSRF in financial transaction handlers](https://junglewise.ai/threats/cve-2026-80210-frontaccounting-csrf-in-financial-transaction-handlers)
- [FrontAccounting SQL injection in Audit Trail report handler](https://junglewise.ai/threats/cve-2026-40523-frontaccounting-sql-injection-in-audit-trail-report-handler)
- [FrontAccounting SQL injection in Bank Statement report](https://junglewise.ai/threats/cve-2026-40522-frontaccounting-sql-injection-in-bank-statement-report)
- [FrontAccounting path traversal and RCE in attachment upload handler](https://junglewise.ai/threats/cve-2026-40521-frontaccounting-path-traversal-and-rce-in-attachment-upload)