ITFlow up to 26.06 Share Link Generator agent/ajax.php share_generate_link expires sql injection

Summaryinfo

A vulnerability was found in ITFlow up to 26.06. It has been rated as critical. This affects the function share_generate_link of the file agent/ajax.php of the component Share Link Generator. The manipulation of the argument expires leads to sql injection. This vulnerability is uniquely identified as CVE-2026-54597. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ITFlow up to 26.06 and classified as critical. This issue affects the function share_generate_link of the file agent/ajax.php of the component Share Link Generator. The manipulation of the argument expires with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-54597 since 06/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

By approaching the search of inurl:agent/ajax.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.07 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• ITFlow

Version

• 26.06

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion