CVE-2026-40523: FrontAccounting SQL Injection Vulnerability

CVE-2026-40523 Overview

CVE-2026-40523 is a SQL injection vulnerability in FrontAccounting versions before 2.4.20. The flaw resides in the Audit Trail report handler within reporting/rep710.php and related database code in gl/includes/db/gl_db_trans.inc. Authenticated users holding the SA_GLANALYTIC permission can inject SQL payloads through the PARAM_2 and PARAM_3 POST parameters. Exploitation permits time-based blind extraction using SLEEP() amplified across JOIN result sets, or UNION-based queries that read arbitrary database content. The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can extract sensitive database contents or exhaust database connections, resulting in denial of service against the accounting platform.

Affected Products

FrontAccounting ERP versions prior to 2.4.20
FrontAccounting reporting/rep710.php Audit Trail report handler
FrontAccounting gl/includes/db/gl_db_trans.inc general ledger database layer

Discovery Timeline

2026-06-29 - CVE-2026-40523 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-40523

Vulnerability Analysis

The vulnerability exists in FrontAccounting's Audit Trail reporting logic. The rep710.php script accepts user-controlled report parameters and forwards them to database query builders without proper escaping. Values delivered through PARAM_2 and PARAM_3 are concatenated directly into the SQL string that filters general ledger transactions. Because the concatenation happens inside a query that joins multiple tables, injected SLEEP() calls execute once per joined row. This amplification enables authenticated attackers to consume database threads rapidly and starve the connection pool. Attackers with the SA_GLANALYTIC role can also append UNION SELECT statements to exfiltrate arbitrary tables, including credential and customer data.

Root Cause

The root cause is missing input escaping in the filter_type, dimension, and bank account identifier arguments used to construct SQL queries. The pre-patch code passed these values directly into query strings without invoking db_escape(). FrontAccounting relies on db_escape() to neutralize special characters, and its absence in these code paths permits SQL syntax breakout.

Attack Vector

Exploitation requires an authenticated session with SA_GLANALYTIC permission. The attacker submits a crafted POST request to the audit trail report endpoint with malicious values in PARAM_2 or PARAM_3. Network access to the FrontAccounting web interface is sufficient, and no user interaction is required beyond the attacker's own authenticated session.

php

// Patch: reporting/rep601.php - add db_escape() around user input
	recalculate_cols($cols);
	$sql = "SELECT id, bank_account_name, bank_curr_code, bank_account_number FROM ".TB_PREF."bank_accounts";
	if ($acc != ALL_TEXT)
-		$sql .= " WHERE id = $acc";
+		$sql .= " WHERE id = ".db_escape($acc);
	$result = db_query($sql, "could not retreive bank accounts");

Source: FrontAccounting GitHub Commit 647a181

text

// Patch: gl/includes/db/gl_db_trans.inc - escape filter_type parameter
     if ($filter_type != null)
-        $sql .= " AND gl.type IN (" . $filter_type .")";
+        $sql .= " AND gl.type IN (" . db_escape($filter_type) .")";

Source: FrontAccounting GitHub Commit 647a181

Detection Methods for CVE-2026-40523

Indicators of Compromise

POST requests to reporting/rep710.php containing SQL keywords such as SLEEP, UNION, SELECT, or BENCHMARK in the PARAM_2 or PARAM_3 fields.
Sudden spikes in MySQL thread counts or max_connections exhaustion originating from the FrontAccounting application user.
Audit trail report requests submitted by accounts with SA_GLANALYTIC outside of normal business hours.
Long-running queries containing information_schema references originating from the FrontAccounting database session.

Detection Strategies

Deploy web application firewall rules that inspect PARAM_2 and PARAM_3 POST body fields for SQL metacharacters and time-function keywords.
Enable MySQL general query log or slow query log and alert on queries against the general ledger tables that include SLEEP( or UNION SELECT.
Correlate authenticated FrontAccounting session identifiers with anomalous report generation frequency.

Monitoring Recommendations

Monitor database connection pool utilization and alert when concurrent sessions from the ERP host exceed baseline thresholds.
Review FrontAccounting user role assignments periodically and restrict SA_GLANALYTIC to accountants who require analytics access.
Retain HTTP access logs for the /reporting/ path for at least 90 days to support post-incident analysis.

How to Mitigate CVE-2026-40523

Immediate Actions Required

Upgrade FrontAccounting to version 2.4.20 or later, which contains the patched db_escape() calls in the audit trail and bank reporting code paths.
Audit all accounts holding the SA_GLANALYTIC permission and revoke access for users who do not require audit trail reporting.
Rotate database credentials if evidence of SQL injection abuse is present in application or database logs.

Patch Information

The fix is committed in FrontAccounting commit 647a181 and shipped in the FrontAccounting 2.4.20 release. Additional technical analysis is available in the Jiva Security writeup and the VulnCheck advisory.

Workarounds

Restrict network access to the FrontAccounting web interface using firewall rules or VPN gating until patching is complete.
Temporarily remove the SA_GLANALYTIC permission from all roles to block access to the vulnerable audit trail report handler.
Deploy a WAF rule that blocks POST bodies to rep710.php containing SQL keywords in report parameters.

bash

# Example WAF rule to block SQL keywords in FrontAccounting report parameters
SecRule REQUEST_URI "@contains /reporting/rep710.php" \
    "phase:2,deny,status:403,id:1004052026,\
    chain,msg:'Blocked SQLi attempt against FrontAccounting audit trail'"
    SecRule ARGS:PARAM_2|ARGS:PARAM_3 "@rx (?i)(union\s+select|sleep\s*\(|benchmark\s*\(|information_schema)"