Akaunting Denial-of-Service Vulnerability in the Localisation Settings Component

A denial-of-service vulnerability has been identified in Akaunting versions through 3.1.19. This issue allows authenticated attackers to disrupt service by sending a crafted POST request to the 'settings/localisation' component. The vulnerability arises from the application not properly validating the 'timezone' value before applying it, which can lead to a 500 Internal Server Error.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, where the application fails to respond properly and instead returns a 500 Internal Server Error.

Reproduction

To reproduce this vulnerability, log into an affected Akaunting application and navigate to the 'settings/localisation' page. Once there, modify the 'timezone' field by entering a non-existent or incorrect value, and then save the changes. After refreshing the page, a 500 Internal Server Error will be displayed, indicating that the denial-of-service condition has been triggered.

Remediation

Users can upgrade to Akaunting version 3.1.19 or later to address this vulnerability.