Executive brief
ITFlow is an IT documentation and ticketing system used by managed service providers to manage customer data, credentials, and support tickets. An authenticated attacker with appropriate permissions can exploit a time-based SQL injection flaw to extract sensitive information including password hashes, SMTP credentials, API keys, and encrypted vault data, potentially leading to account takeover and administrative access.
Technical details
A time-based blind SQL injection vulnerability exists in the share_generate_link handler (agent/ajax.php) where the expires parameter is improperly sanitized before insertion into a MySQL INTERVAL expression. The sanitizeInput function applies only string-context escaping, but since the parameter is inserted unquoted into the item_expire_at INTERVAL calculation, an attacker can craft a malicious expression to execute conditional database queries. The vulnerability requires authentication and the module_support write permission plus access to a credential record. By analyzing response delays, an attacker can infer database contents and extract sensitive data including credential hashes and encryption keys. The issue is fixed in version 26.07 by using intval() type casting on the expires parameter.
Affected products
- ITFlow ITFlow prior to 26.07
Timeline
- 2026-09-17: disclosed
- 2026-07-01: patched