Description

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-17T21:17:16.830Z",
  "pubdate": "2026-09-17T21:17:16.830Z",
  "executiveSummary": "A time-based blind SQL injection vulnerability exists in ITFlow prior to version 26.07, located within the 'agent/ajax.php' script.\nThe vulnerability occurs due to improper neutralization of user-supplied data within the 'expires' parameter, which is processed by the 'share_generate_link' handler.\nAn authenticated user possessing 'module_support' write permissions can exploit this flaw to execute arbitrary SQL queries against the underlying database.\nBy manipulating the 'expires' input, an attacker can trigger conditional delays in server responses, allowing for the systematic extraction of sensitive data such as password hashes, SMTP credentials, API keys, and encrypted vault records.\nThis vulnerability presents a critical risk, as successful exploitation enables unauthorized data exfiltration and potential administrative takeover of the system.\nExploitation requires authenticated access with specific module privileges, limiting the initial attack surface to established users, though the potential for lateral movement and credential compromise is significant.",
  "technicalDetails": "The vulnerability resides in the 'agent/ajax.php' file, specifically within the 'share_generate_link' handler functionality. The root cause is the improper handling of the 'expires' parameter before its inclusion in a MySQL query.\nWhile the application utilizes 'sanitizeInput' to perform string-context escaping, this sanitization is insufficient for the 'expires' parameter. The parameter is inserted unquoted directly into a MySQL 'INTERVAL' expression (e.g., 'item_expire_at MySQL INTERVAL [expires]').\nBecause the input is not treated as a string literal, the application fails to prevent the injection of arbitrary SQL syntax. An attacker can craft malicious inputs that break out of the intended interval logic to append conditional SQL commands.\nThe exploitation method relies on time-based blind SQL injection. By injecting a payload containing a 'SLEEP()' command or a heavy conditional query that forces a delay, an attacker can infer the results of their query based on the time taken for the server to return a response.\nThe attack flow follows these steps: 1) The attacker authenticates as a user with 'module_support' write permissions. 2) The attacker intercepts a request to 'share_generate_link'. 3) The attacker modifies the 'expires' parameter to include a crafted SQL payload that performs a binary search or character-by-character extraction of database data (e.g., '1 DAY + (SELECT IF(SUBSTRING(password,1,1)='a', SLEEP(5), 0) FROM users WHERE id=1)'). 4) By observing the presence or absence of a 5-second response delay, the attacker reconstructs the target data.\nThe scope of impact is severe, as the database contains high-value targets including vault data, credentials for external services (SMTP/API), and internal system metadata. By exfiltrating administrative password hashes, the attacker can move from a restricted account to full system compromise through subsequent credential cracking.\nThis issue affects all versions of ITFlow prior to 26.07. The vulnerability is fundamentally a failure to implement parameterized queries or strict type-casting for inputs that are syntactically integrated into SQL command expressions."
}