CVE-2026-40523
HighCVSS 8.1Summary
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler. Authenticated attackers with SA_GLANALYTIC permission can inject malicious code into PARAM_2 and PARAM_3 POST parameters to execute arbitrary SQL queries.
Risk Assessment
Attackers can exploit time-based blind SQL injection (SLEEP) to exhaust database connections causing denial of service, or use UNION-based techniques to extract arbitrary database content.
Recommendation
Immediately upgrade FrontAccounting to version 2.4.20 or later. Restrict SA_GLANALYTIC permissions to trusted users only.
Original NVD description (English source)
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content through UNION-based injection techniques.