CVE-2019-5720

2022-10-0316:19:44

mitre

www.cve.org

frontaccounting

sql injection

vulnerability

reference field

void_transaction.php

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.6%

JSON

includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.

References

github.com/FrontAccountingERP/FA/issues/38