CVE-2024-23831

LedgerSMB is a free web-based double-entry accounting system. When a
LedgerSMB database administrator has an active session in /setup.pl, an
attacker can trick the admin into clicking on a link which automatically
submits a request to setup.pl without the admin’s consent. This request can
be used to create a new user account with full application (/login.pl)
privileges, leading to privilege escalation. The vulnerability is patched
in versions 1.10.30 and 1.11.9.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1062845&gt;