SQL Injection in FrontAccounting Bank Statement Reports

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

FrontAccounting versions before 2.4.20 suffer from a critical SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to manipulate database queries through unsanitized POST parameters. By injecting UNION SELECT payloads into the PARAM_0 parameter, attackers can bypass the application's query logic and extract arbitrary data from the database—including usernames, password hashes, and email addresses from the users table. These results are rendered directly into PDF report output, making exfiltration seamless. With a CVSS score of 7.1, this vulnerability poses a significant risk to organizations using vulnerable FrontAccounting instances, particularly those storing sensitive financial and user data. The vulnerability stems from CWE-89 (SQL Injection) and CWE-916 (Use of Insufficiently Trusted Source), reflecting both improper input validation and reliance on untrusted user-controlled parameters in SQL construction.

Casky's extended reasoning engine, powered by Claude AI, detects the attack patterns behind this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Exfiltration). Practitioners using Casky will observe findings that highlight suspicious POST parameter manipulation in report handlers, particularly where UNION SELECT keywords appear in parameter values—a hallmark of SQL injection attempts. The platform's 322 matching skills enable detection of data staging and exfiltration activities, including anomalous PDF report generation containing unexpected database schema information. Security teams will see alerts correlating authenticated user sessions with atypical SQL query patterns, parameter encoding bypasses, and attempts to access user tables outside normal reporting scope. By analyzing request parameters against known SQL injection signatures and monitoring report output for non-standard data extraction, Casky helps practitioners identify compromised accounts attempting to weaponize the Bank Statement report feature before sensitive data reaches attackers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-40522.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-40522

Casky has 322 skills that investigate the attack patterns behind CVE-2026-40522. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn