FrontAccounting before version 2.4.20 is vulnerable to SQL injection in the Bank Statement report handler (rep601.php). By injecting UNION SELECT code into the PARAM_0 POST parameter, an authenticated user can embed arbitrary SQL in an unparameterized WHERE clause. This allows extraction of sensitive information, including usernames, password hashes, and email addresses, which is then rendered into a PDF report output.

The affected product is FrontAccounting for versions earlier than 2.4.20. Customers using FrontAccounting 2.4.19 or older are exposed. The newer release 2.4.20 incorporates a fix.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. No EPSS score is published, and the issue is not listed in the CISA KEV catalog, suggesting a lower known exploitation probability. However, the flaw requires authenticated access, and attackers can harvest database contents once authenticated, which remains a serious risk in environments where user credentials are shared or weak.