Executive brief
FrontAccounting is an open-source web-based accounting and ERP system used for invoicing, banking, and financial management. The application generates CSRF tokens on forms but fails to validate them in critical financial transaction endpoints (journal entries, invoices, payments, bank transactions). An attacker can trick an authenticated user into loading a malicious page and auto-submit forged transactions that will be executed under the victim's session, resulting in unauthorized journal entries, invoices, payments, or company configuration changes.
Technical details
FrontAccounting implements CSRF token generation in the end_form() function (includes/ui/ui_controls.inc) and embeds tokens as a _token hidden field in every form. However, token validation via check_csrf_token() is performed only in admin/users.php and admin/change_current_user_password.php. Critical financial transaction handlers including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php, and admin/company_preferences.php do not validate the CSRF token, leaving them vulnerable to cross-origin request forgery attacks. An attacker who can get an authenticated user to visit a malicious page can auto-submit a form to any of these endpoints and have transactions recorded without origin verification. A patch would require adding check_csrf_token() calls to all unprotected financial endpoints.
Affected products
- FrontAccounting FrontAccounting through 2.4.20
Timeline
- 2026-08-27: disclosed