William Visée

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.

**Name of the Vulnerable Software and Affected Versions** TIM Flow versions prior to 26.0.6 **Description** Remote attackers can perform CRLF injection—a technique used to insert carriage return and line feed characters into a stream—by embedding unsanitized sequences in the `rt` URL parameter and the `access token` cookie. These inputs are reflected into Set-Cookie response headers, allowing the injection of arbitrary HTTP headers and response body content. This can be used to induce authenticated users to execute arbitrary JavaScript in their browser context, potentially leading to session token theft and account credential modification. **Recommendations** Update TIM Flow to version 26.0.6 or later. Avoid using the `rt` URL parameter and the `access token` cookie until the update is applied.