CVE-2026-54597 Details

A time-based blind SQL injection vulnerability has been identified in ITFlow, an IT documentation, ticketing, and accounting system for small managed service providers. This vulnerability exists in versions prior to 26.07 and allows an authenticated user with module_support write permission to exploit the expires parameter of the share_generate_link handler in agent/ajax.php. The issue arises because the expires parameter is inserted into a MySQL INTERVAL expression without proper quoting, enabling the execution of conditional database queries. Exploitation of this vulnerability could lead to the exposure of sensitive information such as password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata, and could facilitate an administrative takeover after credential cracking.

This vulnerability has been fixed in ITFlow version 26.07. Users should update to this version to address the issue.