FrontAccounting versions prior to 2.4.20 contain a flaw in the Audit Trail report handler that lets an authenticated user with the SA_GLANALYTIC permission inject arbitrary SQL through the PARAM_2 and PARAM_3 POST parameters. By using time‑based blind techniques such as SLEEP() or UNION‑based payloads the attacker can execute commands against the database, extract data, or exhaust database connections, leading to denial of service.

FrontAccounting Financial Management software from the FrontAccounting vendor, specifically any installation using a version earlier than 2.4.20.

With a CVSS score of 7.2 the vulnerability is considered high severity. No EPSS data is available, and the issue is not listed in the CISA KEV database. Successful exploitation requires user authentication and possession of the SA_GLANALYTIC role; attackers can prolong requests to flood database connections or leverage UNION statements to pull information, making the vulnerability both impactful and exploitable in environments where the privileged role is widely distributed.