Read the docs
TI-2026-29269 Aliases CVE-2026-40522GHSA-53v3-ffpm-f9hw

FrontAccounting < 2.4.20 SQL Injection via rep601.php

Priority MEDIUM 64CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed FrontAccounting (FrontAccounting): 2.4.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FrontAccountingFrontAccountingbefore 2.4.202.4.20Patch availableCNA
  • FrontAccounting VendorFrontAccounting Affected before 2.4.20 Fixed in 2.4.20 Patch available CNA

Remediation

  • Fix · CNA FrontAccounting (FrontAccounting) Fixed in 2.4.20

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FrontAccounting 2.4.20

    4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-29268 FrontAccounting < 2.4.20 Path Traversal RCE via attachment uploadPriority HIGH 73
    • TI-2026-29271 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()Priority HIGH 65
    • TI-2026-29270 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.phpPriority HIGH 65
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40522
  2. 2026-10-03 Alias added: GHSA-53v3-ffpm-f9hw

References

Exploit 1

Patch 1

Other 1

  • TI-2026-29268 FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload CVSS 4.0HIGH 8.7
  • TI-2007-04142 PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31… CVSS 2.0HIGH 7.5
  • TI-2026-29271 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions() CVSS 4.0HIGH 7.2
  • TI-2026-29270 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php CVSS 4.0HIGH 7.2
  • TI-2007-04929 Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when… CVSS 2.0HIGH 9.3
  • TI-2019-04054 includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection… CVSS 3.0CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences