CVE-2018-7176 in FrontAccounting
Summary
by MITRE
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/15/2025
FrontAccounting version 2.4.3 contains a cross-site request forgery vulnerability that allows unauthorized attackers to create new user accounts through the administrative user management interface. This flaw exists in the admin/users.php endpoint which handles user permission management and account creation functionality. The vulnerability arises from the absence of proper anti-CSRF tokens or validation mechanisms when processing user addition requests, making it possible for malicious actors to craft specially crafted requests that, when executed by an authenticated administrator, will create new user accounts without the administrator's knowledge or consent. The attack typically involves tricking a logged-in administrator into visiting a malicious website or clicking on a compromised link that automatically submits a request to the FrontAccounting application's user creation endpoint. This vulnerability falls under CWE-352, which specifically addresses cross-site request forgery conditions where the application fails to validate the origin of requests. The impact of this vulnerability extends beyond simple account creation as it enables attackers to potentially escalate privileges or establish persistent access points within the system. According to ATT&CK framework, this represents a technique under T1078 Valid Accounts where attackers can establish new accounts to maintain access. The operational consequences include unauthorized access to sensitive financial data, potential privilege escalation, and the ability to manipulate user permissions for malicious purposes. Attackers could leverage this vulnerability to create accounts with administrative privileges, effectively compromising the entire system. The vulnerability affects the authentication and authorization mechanisms of FrontAccounting, specifically targeting the user management module that should enforce strict access controls and validation of user creation requests. Organizations using FrontAccounting 2.4.3 should immediately implement mitigations including the addition of anti-CSRF tokens to all state-changing operations, implementation of proper request origin validation, and ensuring that all administrative functions require explicit user confirmation before executing sensitive operations. Additionally, network segmentation and monitoring of administrative user activities can help detect unauthorized account creation attempts. The vulnerability demonstrates a critical flaw in the application's security design where the principle of least privilege and proper request validation are not adequately enforced, making it easier for attackers to exploit the system through social engineering or compromised user sessions. This issue highlights the importance of implementing comprehensive security controls for administrative interfaces and the necessity of validating all user interactions to prevent unauthorized modifications to system configurations and user access rights.