CVE-2025-67081: SQL Injection
An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an administrative account and access to the profile-editing functionality. The provided CVSS vector also indicates that exploitation is network-accessible, requires high privileges, and does not require user interaction.
What can an attacker obtain through successful exploitation?
The flaw supports blind SQL injection through the role_id parameter, allowing extraction of arbitrary data from the database. The listed impact is high confidentiality impact, with no stated integrity or availability impact.
How can I determine whether my deployment is affected?
Deployments of Itflow through version 25.06 are identified as affected. Review profile-edit requests for manipulation of the role_id parameter, particularly from administrative accounts, as an indicator of attempted exploitation.