CVE-2026-54596

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07

Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint via the frequency parameter. Although the recurring invoice frequency is processed by sanitizeInput(), it is interpolated unquoted into a DATE ADD function, allowing SQL syntax to escape the interval expression. This enables an attacker to assign additional INSERT columns and store subquery results in recurring invoice note, which are then exposed through the 'agent/recurring invoice.php' endpoint. Additionally, the stored recurring invoice frequency can trigger a second-order injection when used in a subsequent UPDATE operation by another user. This can lead to the exposure of password hashes, SMTP credentials, user records, and database metadata, as well as the modification of database fields and potential administrative takeover.

Recommendations Update to version 26.07.