Threats tagged 'ghsa-53v3-ffpm-f9hw'

FrontAccounting versions before 2.4.20 contain a SQL injection vulnerability in the Bank Statement report handler. Authenticated attackers can exploit this by injecting UNION SELECT payloads into the PARAM_0 POST parameter. This allows extraction of arbitrary database data, including sensitive user information such as usernames, password hashes, and email addresses, which are rendered in the PDF report output.