SQL Injection in FrontAccounting GL Transaction Filtering

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

FrontAccounting versions before 2.4.20 contain a critical SQL injection vulnerability in the get_gl_transactions() function where user-supplied filter_type parameters are concatenated directly into SQL IN() clauses without parameterization. This vulnerability carries a CVSS score of 8.1 and affects users with SA_GLANALYTIC permissions, allowing attackers to inject arbitrary SQL commands and extract sensitive financial data through boolean-based blind SQL injection techniques. The attack exploits inadequate input validation on a function responsible for retrieving general ledger transactions, making this particularly dangerous for financial systems where journal entries and account data are sensitive and often subject to regulatory compliance requirements.

Casky's 322 matched skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across two key MITRE ATT&CK techniques: Initial Access (TA0001) and Reconnaissance (TA0043). Practitioners using Casky would identify suspicious activity through detection of SQL metacharacter sequences in filter_type parameters, analysis of unusual response size differentials indicating blind SQL injection probing, and monitoring for attempts to access the get_gl_transactions() function with elevated permissions. The platform's skill mapping would flag requests containing SQL operators like parentheses and logical conditions injected into what should be simple filter values, correlate these patterns with permission escalation checks for SA_GLANALYTIC access, and generate findings that highlight the progression from reconnaissance (identifying injectable parameters) through exploitation (extracting unauthorized data). Security teams would see specific indicators such as malformed IN() clause syntax in query logs, repeated requests with boolean conditions designed to test true/false outcomes, and abnormal database response patterns that characterize blind injection attacks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-40524.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-40524

Casky has 322 skills that investigate the attack patterns behind CVE-2026-40524. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn