CVE-2026-40523 — FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execu…
Published: 2026-06-29 · CVSS: 7.2 · CVSS 4.0
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content through UNION-based injection techniques.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7