FrontAccounting 2.4.19 Time-Based Blind SQL Injection Vulnerability (CVE-2026-40523) and Fix

Vulnerability Overview Vulnerability Name: Time-Based Blind SQL Injection (Time-Based Blind SQLi) Vulnerability Description: A time-based blind SQL injection vulnerability has been identified in the audit trail report ( ) of FrontAccounting 2.4.19. This vulnerability allows injection via the and parameters, utilizing the function to create a time delay, thereby enabling the inference of database contents. Vulnerability Type: Time-Based Blind SQL Injection Vulnerability Location: Vulnerable Parameters: (integer type), (string type) Scope of Impact Affected Versions: FrontAccounting 2.4.19 Severity: High (CVSS 8.8) Potential Impact: - Attackers can infer database contents through time delays, potentially leading to the leakage of sensitive information. - Under high concurrency, this may lead to database connection pool exhaustion, resulting in Denial of Service (DoS). Remediation Steps Immediate Fixes: - Apply integer casting to the parameter: - Apply string escaping to the parameter: System-Level Recommendations: - Report modules should use parameterized queries or database driver escape functions. - The report scheduler ( ) should enforce this before delegating to individual report files. - Consider query timeouts (such as hints or configurations) as a defense-in-depth measure. Proof of Concept (POC) Code Time-Based Blind SQLi POC: POC with Injection: Disclosure Timeline 2026-04-15: Vulnerability discovered during independent security research 2026-04-16: Vendor notified with detailed technical specifics 2026-04-17: Vendor acknowledgment 2026-04-27: CVE-2026-40523 assigned 2026-04-29: Version 2.4.20 released with the fix 2026-06-27: Public disclosure Additional Information Vulnerability Series: This is the third part of a series regarding vulnerabilities in FrontAccounting 2.4.19; the first two parts covered path traversal leading to RCE and UNION-based SQL injection. Next Part: The fourth part will cover Boolean-based SQL injection, utilizing an clause to create a response size oracle. Summary The audit trail report in FrontAccounting 2.4.19 contains a time-based blind SQL injection vulnerability, allowing attackers to infer database contents through time delays. Immediate remediation and the adoption of system-level security measures are recommended to prevent similar vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

FrontAccounting 2.4.19 Time-Based Blind SQL Injection Vulnerability (CVE-2026-40523) and Fix