FrontAccounting SQL Injection in Audit Trail Report

Executive Summary

CVE-2026-40523 is a high-severity SQL injection vulnerability found in FrontAccounting versions before 2.4.20, specifically in the Audit Trail report handler (rep710.php).

Authenticated attackers with SA_GLANALYTIC permission can inject malicious SQL code into the PARAM_2 and PARAM_3 POST parameters because these inputs are not properly sanitized or parameterized.

The vulnerability allows attackers to perform time-based blind SQL injection using SLEEP() functions, which are amplified across multiple rows in JOIN operations, causing significant delays and potential denial of service by exhausting database connections.

Attackers can also extract arbitrary database content using UNION-based SQL injection techniques.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated attacker with specific permissions to execute arbitrary SQL queries on your database.

• Denial of Service (DoS): Attackers can exploit the time-based blind SQL injection with SLEEP() functions amplified by JOIN operations to exhaust database connections, causing severe delays or outages.
• Data Exposure: Attackers can extract sensitive or arbitrary data from your database using UNION-based SQL injection techniques.

Overall, this can lead to service disruption and unauthorized access to sensitive financial or audit data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual delays or denial-of-service symptoms caused by time-based blind SQL injection attempts using SLEEP() functions amplified across JOIN result sets.

Detection can also involve checking for suspicious POST requests to the Audit Trail report handler (rep710.php) that include malicious payloads in the PARAM_2 and PARAM_3 parameters.

Example commands to detect exploitation attempts might include using web server logs or network monitoring tools to filter POST requests targeting rep710.php with suspicious parameters.

• Using grep on web server logs to find suspicious POST requests: grep 'POST /reporting/rep710.php' /var/log/apache2/access.log | grep -E 'PARAM_2=|PARAM_3='
• Using a network packet capture tool like tcpdump or Wireshark to filter HTTP POST requests to rep710.php and inspect the payload for SQL injection patterns.
• Monitoring database performance for unusual connection exhaustion or delays that could indicate exploitation of the time-based blind SQL injection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating FrontAccounting to version 2.4.20 or later, where the vulnerability has been patched by implementing proper input sanitization and escaping of user-supplied parameters.

If updating is not immediately possible, restrict access to the Audit Trail report handler (rep710.php) to trusted users only, especially those with SA_GLANALYTIC permission.

Implement network-level controls such as web application firewalls (WAF) to detect and block SQL injection attempts targeting the vulnerable parameters.

Review and apply input validation and sanitization best practices, including casting integer parameters and escaping string inputs in any custom or legacy code.

Useful 0 Not Useful 0