CVE-2026-40524 Details
Description
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.
A SQL injection vulnerability has been identified in FrontAccounting versions prior to 2.4.20, specifically within the 'get_gl_transactions()' function. The issue arises because the 'filter_type' parameter is directly concatenated into a SQL IN() clause without proper parameterization. This vulnerability allows attackers with SA_GLANALYTIC permission to inject arbitrary SQL, potentially extracting sensitive journal entry data. The exploitation leverages boolean-based blind SQL injection, taking advantage of reliable differences in response sizes to extract data covertly.
Users can update to FrontAccounting version 2.4.20, which includes the necessary fix. The vulnerability can also be addressed by applying parameterized queries or strict type casting for integer parameters, and proper escaping for string parameters.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524 | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f | [email protected] | Source CodeVendor |
| https://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524 | [email protected] | ExploitRemedyTechnical Analysis |
| https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ | [email protected] | Content WallVendor |
| https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FrontAccounting | < 2.4.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |