Iltosec

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.

**Name of the Vulnerable Software and Affected Versions** ITFlow versions prior to 26.07 **Description** An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint via the `frequency` parameter. Although the `recurring invoice frequency` is processed by `sanitizeInput()`, it is interpolated unquoted into a DATE ADD function, allowing SQL syntax to escape the interval expression. This enables an attacker to assign additional INSERT columns and store subquery results in `recurring invoice note`, which are then exposed through the 'agent/recurring invoice.php' endpoint. Additionally, the stored `recurring invoice frequency` can trigger a second-order injection when used in a subsequent UPDATE operation by another user. This can lead to the exposure of password hashes, SMTP credentials, user records, and database metadata, as well as the modification of database fields and potential administrative takeover. **Recommendations** Update to version 26.07.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Snipe-IT الأقدم من 8.6.0 **الوصف** يمكن للمستخدم الذي يمتلك أذونات `users.edit` وأذونات واجهة برمجة التطبيقات (API) رفع مستوى امتيازاته عن طريق إرسال طلب PATCH إلى نقطة النهاية ’/api/v1/users/{their own id}‘. وهذا يسمح للمستخدم بمنح نفسه أذونات متنوعة، مثل `assets.view` و`assets.create` و`reports.view`، بالإضافة إلى إمكانيات الاستيراد، على الرغم من أنه لا يمكنه منح نفسه صفة المسؤول أو المستخدم المتميز. **التوصيات** التحديث إلى الإصدار 8.6.0.

**Name of the Vulnerable Software and Affected Versions** ITFlow versions prior to 26.07 **Description** An authenticated user with `module support` write permission and access to a credential record can perform time-based blind SQL injection. This occurs because the `expires` parameter of the `share generate link` handler in the `agent/ajax.php` endpoint is inserted unquoted into the `item expire at` MySQL INTERVAL expression. Although `sanitizeInput()` applies string-context escaping, the lack of quoting allows a crafted expression and interval unit to execute conditional database queries, with results inferred from response delays. This can lead to the exposure of password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata, potentially enabling administrative takeover after credential cracking. **Recommendations** Update to version 26.07. Avoid using the `expires` parameter in the `share generate link` handler until the update is applied.