Executive brief
FrontAccounting is an open-source enterprise resource planning (ERP) system used to manage business operations and accounting. The software stores user passwords as unsalted MD5 hashes, a cryptographically weak practice that allows attackers who gain access to the user database to recover plaintext passwords rapidly using precomputed lookup tables or GPU-based cracking. This could lead to unauthorized system access and potential compromise of sensitive financial and operational data.
Technical details
FrontAccounting through version 2.4.20 uses unsalted MD5 hashing for password storage and authentication across multiple code paths: admin/users.php, admin/change_current_user_password.php, and the forgotten-password recovery in includes/current_user.inc all pass md5($_POST['password']) directly to password functions. The authentication process calls get_user_auth($loginname, md5($password)), comparing MD5 digests without any per-password salt or adaptive hashing algorithm. Identical passwords produce identical digests, enabling rapid plaintext recovery via rainbow tables or high-rate GPU cracking if the user table is obtained through SQL injection, database breach, or file system access. No patch status is publicly documented; mitigation requires migrating to bcrypt, scrypt, or Argon2-based hashing with proper salting.
Affected products
- FrontAccounting FrontAccounting through 2.4.20
Timeline
- 2026-08-27: disclosed