CVE-2026-40522: FrontAccounting SQL Injection Vulnerability

CVE-2026-40522 Overview

CVE-2026-40522 is a SQL injection vulnerability [CWE-89] affecting FrontAccounting versions prior to 2.4.20. The flaw resides in the Bank Statement report handler (rep601.php), where the PARAM_0 POST parameter is passed directly into a WHERE clause without parameterization. Authenticated attackers can inject UNION SELECT payloads to extract arbitrary database contents, including usernames, password hashes, and email addresses from the users table. The results are rendered into the PDF report output returned to the attacker.

Critical Impact
Authenticated attackers can extract sensitive database records — including credential material — by injecting SQL into an unparameterized report parameter.

Affected Products

FrontAccounting ERP versions prior to 2.4.20
reporting/rep601.php Bank Statement report handler
Related reporting modules patched in commit 894adaf (e.g., rep102.php, rep108.php)

Discovery Timeline

2026-06-29 - CVE-2026-40522 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-40522

Vulnerability Analysis

The vulnerability exists in FrontAccounting's reporting subsystem, specifically the Bank Statement report generated by rep601.php. The handler accepts user-supplied POST parameters that select the report scope and passes them directly into dynamically constructed SQL statements. Because PARAM_0 is concatenated into the WHERE clause without escaping or binding, an authenticated user can terminate the intended predicate and append a UNION SELECT query. The resulting rows are then rendered into the PDF output, providing an oracle for arbitrary data extraction.

Root Cause

The root cause is unparameterized string interpolation of untrusted input into SQL queries across several report handlers. FrontAccounting's codebase rules require input to pass through db_escape() before inclusion in SQL, but multiple report procedures ignored that convention. The vendor patch (894adaf71393e0ef6a04fe6036fcd2464050f590) refactors these functions to escape inputs and remove untrusted values from query construction.

Attack Vector

An authenticated attacker submits a crafted POST request to the Bank Statement report endpoint with a malicious PARAM_0 value. The injected payload closes the original clause and appends a UNION SELECT referencing the users table. The report engine executes the query and embeds the returned rows into the generated PDF, disclosing credential material to the attacker.

php

// Vendor patch excerpt from reporting/rep102.php — commit 894adaf
// Before: $customer_id concatenated directly into SQL
// After:  db_escape($customer_id) enforces safe quoting

		FROM ".TB_PREF."debtor_trans trans

		WHERE type <> ".ST_CUSTDELIVERY."
-			AND debtor_no = $customer_id
+			AND debtor_no = ".db_escape($customer_id)."
			AND tran_date <= '$todate'
			AND ABS($value) > " . FLOAT_COMP_DELTA;
// Source: https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590

Detection Methods for CVE-2026-40522

Indicators of Compromise

POST requests to reporting/rep601.php (and other rep*.php endpoints) containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the PARAM_0 value.
Unexpected PDF report generation events tied to accounts that do not normally run Bank Statement reports.
Web server access logs showing long or URL-encoded PARAM_0 values inconsistent with UI-driven report submissions.

Detection Strategies

Deploy web application firewall signatures that inspect PARAM_0 and related report parameters for SQL metacharacters and UNION-based patterns.
Enable database query logging on the FrontAccounting schema and alert on queries against the users table originating from report procedures.
Correlate authenticated session identifiers with anomalous report parameter payloads to identify malicious insiders or compromised accounts.

Monitoring Recommendations

Monitor for successive report requests from the same session that vary only in PARAM_0, indicating iterative SQL injection probing.
Track outbound PDF sizes and content anomalies from the reporting module for signs of data exfiltration.
Audit FrontAccounting user accounts for unexpected password resets or logins following suspicious report activity.

How to Mitigate CVE-2026-40522

Immediate Actions Required

Upgrade FrontAccounting to version 2.4.20 or later, which incorporates commit 894adaf71393e0ef6a04fe6036fcd2464050f590.
Rotate all FrontAccounting user credentials and any shared database secrets, assuming the users table may have been exposed.
Restrict access to the reporting module to trusted roles and enforce least privilege on the database account used by the application.

Patch Information

The upstream fix is delivered in FrontAccounting 2.4.20, referenced in the SourceForge Release Announcement. The corresponding source change is available in the GitHub Commit Update. Technical details are documented in the VulnCheck Security Advisory and the Jiva Security Writeup.

Workarounds

Block access to reporting/rep601.php at the reverse proxy or web server layer until the patch is applied.
Deploy a WAF rule that rejects requests containing SQL keywords in PARAM_0 and related report parameters.
Reduce the FrontAccounting database user's privileges so it cannot read the users table from report contexts.

bash

# Example nginx rule to block SQLi patterns in the Bank Statement report parameter
location ~ ^/reporting/rep601\.php$ {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "PARAM_0=[^&]*(union|select|information_schema|sleep\()") {
            set $block 1;
        }
        if ($block = 1) { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}