A vulnerability has been discovered in FrontAccounting, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to the /admin/attachments.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
Successful exploitation requires permissions to attach documents.
The vulnerability is confirmed in version 2.3.19. Prior versions may also be affected.
