Description

includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.

Remediation

References

CVE-2019-5720

Related Vulnerabilities

WordPress Plugin Daily Prayer Time Cross-Site Scripting (2021.08.07)

SharePoint CVE-2023-21742 Vulnerability (CVE-2023-21742)

WordPress Plugin YITH WooCommerce Brands Add-On Security Bypass (1.3.6)

Oracle JRE CVE-2014-2409 Vulnerability (CVE-2014-2409)

WordPress Plugin WP Symposium 'get_profile_avatar.php' SQL Injection (0.64)

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2019-5720