FrontAccounting versions earlier than 2.4.20 allow attackers with SA_GLANALYTIC permission to perform SQL injection in the get_gl_transactions() function. The filter_type parameter is directly concatenated into a SQL IN clause, enabling boolean‑based blind injection that can extract confidential journal entries through size differentials. This flaw is a classic evidence‑based injection weakness (CWE‑89) and provides unauthorized disclosure of sensitive accounting data.

All FrontAccounting installations running version 2.x prior to 2.4.20. The vendor is FrontAccounting. Users should verify that their instance does not exceed 2.4.19 and that no unpatched code remains.

The CVSS score of 7.2 indicates a high impact with limited required privileges. Exploitation requires an authenticated user with SA_GLANALYTIC rights, which limits the attack surface but still poses a serious threat if such permissions are mis‑assigned. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the ability to disclose financial records elevates its priority for patching.