PT-2026-53269 · Frontaccounting · Frontaccounting

Jiva · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-40522

NVD

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM 0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-916

CWE-89

Identificadores relacionados

CVE-2026-40522

Produtos afetados

Frontaccounting

Referências · 5

• 🔥 https://jivasecurity.com/writeups/frontaccounting-sqli-bank-statement-report-cve-2026-40522 · Exploit
• https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-40522 · Nota de Segurança
• https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420 · Nota
• https://vulncheck.com/advisories/frontaccounting-sql-injection-via-rep601-php · Nota