A SQL injection vulnerability exists in FrontAccounting prior to version 2.4.20 within the Bank Statement report handler. The vulnerability arises because the PARAM_0 POST parameter is used in an unparameterized WHERE clause, enabling authenticated attackers to inject malicious SQL UNION SELECT statements. This injection can be used to retrieve sensitive data from the database, including user credentials and emails, which are then included in the generated PDF reports.

Successful exploitation allows an authenticated attacker to extract sensitive database information, including usernames, password hashes, and email addresses from the users table. This exposure can lead to credential compromise and further system intrusion. The vulnerability affects confidentiality and potentially integrity of the data processed by the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Bank Statement report handler to trusted users only and monitor for suspicious activity related to report generation.