SQL Injection in Frontaccounting
CVE-2026-40523
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content through UNION-based injection techniques.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (38.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Frontaccounting — versions 0, 647a18196caad27f96ea852e993c9e30f815357f
Weakness classification (CWE)
References
- jivasecurity.com/writeups/frontaccounting-sqli-audit-trail-report-cve-2026-40523 (technical-description, exploit)
- sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ (release-notes)
- github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f (patch)
- www.vulncheck.com/advisories/frontaccounting-sql-injection-via-reporting-rep710… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-40523?
- CVE-2026-40523 is a high-severity vulnerability in Frontaccounting, classified under SQL Injection. CVSS score: 8.1/10. Published 2026-06-29.
- How severe is CVE-2026-40523?
- High severity. CVSS v3 base score is 8.1 out of 10.