CVE-2026-40524
FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 7.2EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
29 Jun 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
FrontAccounting · FrontAccountingpublic PoCs found — 1
cve_referencejivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357fhttps://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions