Beveiligingsadvies

CVE-2026-40524

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-29 12:27:26

Laatst bijgewerkt 2026-07-14 20:00:36

Toegewezen door VulnCheck

CVSS-score 8.1

Status PUBLISHED

Beschrijving

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

← Alle CVE's bekijken Bekijk op cve.org ↗