CVE-2026-54596 in ITFlow
Summary
by MITRE • 09/18/2026
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The handler passes recurring_invoice_frequency through sanitizeInput but interpolates it unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurring_invoice_note, and expose those results through agent/recurring_invoice.php. The persisted recurring_invoice_frequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
ITFlow serves as a comprehensive IT documentation, ticketing, and accounting platform designed for small managed service providers to manage client relationships and operational workflows. A critical security vulnerability was identified within versions prior to 26.07 that affects the recurring invoice generation functionality. This flaw allows authenticated users with Technician privileges or higher, provided they have access to at least one client invoice, to execute SQL injection attacks against the underlying database. The vulnerability resides in the agent/post/recurring_invoice.php script, specifically within the handling of the frequency parameter used for scheduling automated invoices. Although the application attempts to mitigate risks by passing this input through a sanitizeInput function, the sanitization process is insufficient because it fails to properly quote or escape the value before it is interpolated into an SQL DATE_ADD expression. This architectural oversight creates a pathway for attackers to break out of the intended interval syntax and inject arbitrary SQL commands directly into the database query structure.
The technical mechanism of this exploitation involves manipulating the recurring_invoice_frequency parameter to close the existing date arithmetic operation and append malicious SQL statements. Because the value is inserted unquoted, an attacker can craft input that escapes the context of a simple date calculation and instead modifies the surrounding INSERT statement. This allows for second-order effects where injected payloads are stored in the database rather than executed immediately during the request phase. Specifically, attackers can exploit this to assign additional columns within the INSERT operation or store results from subqueries into the recurring_invoice_note field. Once these malicious values are persisted in the database, they remain dormant until triggered by subsequent legitimate operations. The most significant trigger for this second-order execution is the Force Recurring feature, which utilizes the stored frequency value in a later UPDATE statement. This delayed execution model makes detection more difficult as the initial request appears benign, while the actual damage occurs during routine administrative actions performed by other users or system processes.
The operational impact of this vulnerability is severe and multifaceted, leading to potential full database compromise and unauthorized access to sensitive organizational data. By leveraging SQL injection capabilities, an attacker can extract critical information such as password hashes for all user accounts, SMTP credentials used for email communications, detailed user records containing personal identifiable information, and general database metadata that reveals the schema structure. Beyond data exfiltration, the vulnerability allows for the modification of existing database fields, which could disrupt business operations or alter financial records. The most critical consequence is the potential for administrative takeover. Once password hashes are extracted through this injection vector, attackers can perform offline cracking to obtain plaintext credentials. With valid administrator-level credentials obtained in this manner, an attacker gains complete control over the ITFlow instance, enabling them to manipulate all system configurations, access sensitive client data indefinitely, and potentially use the compromised server as a pivot point for further network attacks against connected systems.
This vulnerability aligns with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific nature of this flaw involves both first-order injection through direct parameter manipulation and second-order injection where stored data is later executed unsafely. In terms of the MITRE ATT&CK framework, this exploitation technique maps to T1059, Command and Scripting Interpreter, specifically when used for database interaction, and falls under the initial access or privilege escalation phases depending on whether it leads directly to admin takeover via credential cracking. The persistence mechanism described also relates to techniques involving stored payloads that trigger upon specific conditions, akin to certain aspects of T1136, Create Account, if new accounts are created through injection, though primarily this is an exploitation of input validation failures leading to data manipulation and exfiltration.
To mitigate the risks associated with CVE-2024-related issues in ITFlow prior to version 26.07, organizations must immediately upgrade to version 26.07 or later where the developer has addressed the sanitization logic for the recurring_invoice_frequency parameter. Until an update is applied, administrators should restrict access to the agent/post/recurring_invoice.php endpoint and related invoice management features to only those users who absolutely require such privileges, adhering to the principle of least privilege. Additionally, implementing Web Application Firewalls with robust SQL injection detection rules may provide a layer of defense by blocking malformed queries that attempt to escape date arithmetic contexts. Monitoring database logs for unusual INSERT or UPDATE operations involving recurring invoices can also help in detecting active exploitation attempts. It is crucial to rotate all user passwords and SMTP credentials immediately after patching, as previous instances of the vulnerability may have already resulted in credential exposure. Regular security audits and penetration testing focused on input validation across all API endpoints are recommended to ensure no similar vulnerabilities exist elsewhere in the application logic.