CVE-2026-54597

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07

Description An authenticated user with module support write permission and access to a credential record can perform time-based blind SQL injection. This occurs because the expires parameter of the share generate link handler in the agent/ajax.php endpoint is inserted unquoted into the item expire at MySQL INTERVAL expression. Although sanitizeInput() applies string-context escaping, the lack of quoting allows a crafted expression and interval unit to execute conditional database queries, with results inferred from response delays. This can lead to the exposure of password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata, potentially enabling administrative takeover after credential cracking.

Recommendations Update to version 26.07. Avoid using the expires parameter in the share generate link handler until the update is applied.