ITFlow, an IT documentation, ticketing, and accounting system, contains an SQL injection vulnerability (CWE-89) in versions before 26.07. The vulnerability arises because the recurring_invoice_frequency parameter is sanitized but then interpolated unquoted into a DATE_ADD SQL function in agent/post/recurring_invoice.php. This allows an authenticated Technician or higher user to inject SQL syntax that escapes the intended interval expression, enabling assignment of additional INSERT columns and storage of subquery results in recurring_invoice_note. These results are exposed through agent/recurring_invoice.php. Furthermore, the persisted malicious frequency value can be reused in a later UPDATE operation triggered by Force Recurring, causing a second-order SQL injection exploitable by other legitimate users. Exploitation can expose sensitive data such as password hashes, SMTP credentials, user records, and database metadata, and can modify database fields to enable administrative takeover after credential cracking. The vulnerability is resolved in version 26.07.

Successful exploitation allows authenticated users with Technician or higher privileges to perform SQL injection attacks that can expose sensitive information including password hashes, SMTP credentials, user records, and database metadata. Attackers can also modify database fields, potentially leading to administrative account takeover after cracking credentials. The vulnerability does not require user interaction beyond authentication and has a low attack complexity.

Upgrade to itflow version 26.07 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.