CVE-2026-40522 Details
Description
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.
A SQL injection vulnerability has been identified in FrontAccounting versions prior to 2.4.20, specifically within the Bank Statement report handler. This vulnerability allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. The injected SQL syntax is executed through an unparameterized WHERE clause, enabling the retrieval of sensitive information such as usernames, password hashes, and email addresses from the users table. The extracted data is then rendered into the PDF report output.
Users are advised to upgrade to FrontAccounting version 2.4.20, which addresses this vulnerability by sanitizing the PARAM_0 input and implementing proper SQL query parameterization. Additionally, the update improves compatibility with PHP versions 8.2 to 8.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590 | [email protected] | Source CodeVendor |
| https://jivasecurity.com/writeups/frontaccounting-sqli-bank-statement-report-cve-2026-40522 | [email protected] | ExploitRemedyTechnical Analysis |
| https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-rep601-php | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FrontAccounting | < 2.4.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |