CVE-2026-54596: ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurringinvoice.php. The handler passes recurringinvoicefrequency through sanitizeInput but interpolates it unquoted into DATEADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurringinvoicenote, and expose those results through agent/recurringinvoice.php. The persisted recurringinvoicefrequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ITFlowto a version that resolves this vulnerability.Fixed in 26.07
Event History
Frequently Asked Questions
Who is exposed to exploitation?
ITFlow deployments before version 26.07 are affected when an authenticated Technician-level or higher user has access to at least one client invoice. The issue is reachable over the network and does not require user interaction.
What does an attacker need to exploit the issue?
An attacker needs valid ITFlow credentials for a Technician or higher role and access to a client invoice. They can submit crafted SQL through the recurring_invoice_frequency parameter handled by agent/post/recurring_invoice.php.
What could an attacker obtain or change?
The injection can expose password hashes, SMTP credentials, user records, and database metadata, and can modify database fields. Password hash exposure may enable administrative takeover after credential cracking.
Can the malicious value have effects after the original request?
Yes. The injected recurring_invoice_frequency value is persisted and can execute again during a later Force Recurring operation, when it is used in an UPDATE. Another legitimate user can trigger this second-order injection.
What version fixes the issue?
Upgrade ITFlow to version 26.07 or later. The provided data does not specify an interim mitigation for deployments that cannot be patched immediately.