PT-2026-53271 · Unknown · Frontaccounting

Jiva · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-40524

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.20

Description An issue exists in the get gl transactions() function where the filter type parameter is concatenated directly into a SQL IN() clause without parameterization. This allows users with SA GLANALYTIC permissions to perform boolean-based blind SQL injection—a technique used to extract data by observing differences in server responses to true or false queries—by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data.

Recommendations Update FrontAccounting to version 2.4.20 or later. As a temporary workaround, restrict the SA GLANALYTIC permission to trusted users only.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-40524

Affected Products

Frontaccounting

References · 6

• 🔥 https://jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524 · Exploit
• https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40524 · Security Note
• https://vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions · Note
• https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420 · Note
• https://twitter.com/VulmonFeeds/status/2071623067525132680 · Twitter Post