CVE-2018-1000890

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/FrontAccountingERP/FA/issues/37Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/46037Exploit, Third Party Advisory, VDB Entry
https://github.com/FrontAccountingERP/FA/issues/37Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/46037Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Dec 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10008917.5Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums.CVE-2018-10008927.5Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages.CVE-2018-10008937.5Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions.CVE-2018-10009976.5A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/ma CVE-2018-10009986.1FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is ano CVE-2018-10017.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip CVE-2018-100165.5Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file.CVE-2018-100176.5soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bo CVE-2018-100188.8The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed arg CVE-2018-10020007.2There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privile CVE-2018-10020014.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ CVE-2018-10020024.8There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ