Akaunting Server-Side Template Injection Vulnerability

A server-side template injection vulnerability has been identified in Akaunting version 3.1.8. This vulnerability allows authenticated administrators to execute template expressions in various form input fields, including items, taxes, transactions, and vendor name fields. The injection can be used to perform arithmetic operations and string manipulations.

Impact

Exploitation of this vulnerability allows for server-side template injection, where an attacker can execute arbitrary template code on the server.

Reproduction

To reproduce this vulnerability, log in as an administrator and navigate to any of the following sections: Items, Taxes, Transactions, or Vendors. In the relevant 'Name' or 'Description' fields, inject a template payload such as '{{7*7}}'. After saving, the injected payload will be executed, demonstrating the template injection vulnerability.