The vulnerability in FrontAccounting prior to version 2.4.20 is a SQL injection flaw located in the Audit Trail report handler. Attackers with authenticated access and SA_GLANALYTIC permission can exploit this by injecting SQL commands into the PARAM_2 and PARAM_3 POST parameters. Exploitation methods include UNION-based injections to extract arbitrary database content and time-based blind SQL injections using SLEEP() functions that are amplified across JOIN result sets, potentially causing denial of service by exhausting database connections.

Successful exploitation allows attackers to execute arbitrary SQL queries on the database, leading to unauthorized data disclosure or denial of service conditions by exhausting database connections. This compromises the confidentiality and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with SA_GLANALYTIC permission and monitor usage of the Audit Trail report handler for suspicious activity.