Description
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FrontAccounting FrontAccounting
Default version status: affected
0 to < 2.4.20affected647a18196caad27f96ea852e993c9e30f815357funaffected
References
- https://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524 ↗
- https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ ↗
- https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f ↗
- https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions ↗