CVE-2026-40524 — FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN…
Published: 2026-06-29 · CVSS: 7.2 · CVSS 4.0
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7