Description

FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T17:20:50.573Z",
  "pubdate": "2026-08-27T17:20:50.573Z",
  "executiveSummary": "FrontAccounting versions up to 2.4.20 are susceptible to Cross-Site Request Forgery (CSRF) vulnerabilities due to an incomplete implementation of security tokens. While the application generates a CSRF token within 'end_form()' in 'includes/ui/ui_controls.inc' and embeds it into forms, this token is not validated by the majority of the application's critical endpoints.\nThe vulnerability allows an unauthenticated remote attacker to perform unauthorized state-changing actions on behalf of an authenticated user. By enticing a logged-in victim to navigate to a malicious web page, an attacker can trigger auto-submitting forms that perform sensitive financial and administrative operations. The lack of origin validation across core modules—including journal entries, bank transactions, invoicing, and company configuration—effectively nullifies the intended security controls. This flaw poses a severe risk to the integrity of financial data, as unauthorized transactions can be injected into the system without the victim's knowledge or consent. Exploitation requires no advanced interaction beyond the user loading a malicious page while maintaining an active session within the vulnerable application.",
  "technicalDetails": "The root cause of this vulnerability lies in the inconsistent enforcement of anti-CSRF measures within the FrontAccounting architecture. While the developer framework includes a mechanism to generate unique tokens via 'end_form()' in 'includes/ui/ui_controls.inc', the backend logic fails to mandate the validation of these tokens through the 'check_csrf_token()' function across most transaction handlers.\nThe vulnerable components include multiple critical financial and administrative endpoints: 'gl/gl_journal.php', 'gl/gl_bank.php', 'purchasing/supplier_invoice.php', 'sales/customer_invoice.php', 'sales/customer_payments.php', and 'admin/company_preferences.php'. Because these scripts do not verify the existence or authenticity of the '_token' field in POST requests, the server-side application processes the requests based solely on the presence of a valid session cookie.\nThe attack flow proceeds as follows: 1) The attacker identifies a target endpoint that lacks token validation. 2) The attacker crafts a malicious external website containing a hidden, auto-submitting HTML form designed to execute a POST request targeting the victim's FrontAccounting instance. 3) The attacker tricks an authenticated victim into accessing the malicious site. 4) The victim's browser, maintaining an active session with the FrontAccounting application, automatically includes the session cookies with the forged request. 5) The server receives the request, ignores the lack of a CSRF token (or the lack of its validation), and executes the transaction as if it originated from the legitimate user interface.\nThe impact is significant, as it enables unauthorized financial record manipulation. An attacker can force the creation of fraudulent journal entries, issue unauthorized invoices, initiate bank transfers, or modify system-wide company preferences. Because the request originates from the victim's authenticated session, all actions are logged as legitimate activities performed by the victim, making detection and forensic analysis difficult. This vulnerability affects all FrontAccounting versions up to 2.4.20. It requires no specific network exposure beyond the standard web access, as the attack leverages the victim's established network path to the application server. The absence of strict origin checks or modern SameSite cookie attributes further exacerbates the risk, allowing simple cross-origin POST requests to succeed consistently."
}