ITFlow, an IT documentation, ticketing, and accounting system, contains a SQL injection vulnerability (CWE-89) in versions before 26.07. The flaw exists in the share_generate_link handler in agent/ajax.php, where the expires parameter is used unquoted in a MySQL INTERVAL expression. Although sanitizeInput applies string-context escaping, it does not prevent injection in this numeric context. An authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection, enabling conditional database queries inferred from response delays. This can lead to exposure of password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata, potentially allowing administrative takeover after credential cracking. The vulnerability is addressed in version 26.07.

Exploitation of this vulnerability can lead to disclosure of highly sensitive information such as password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata. This exposure can facilitate administrative account takeover following credential cracking. The vulnerability requires authenticated access with specific permissions, limiting the attack surface to authorized users with module_support write permission and access to credential records. The CVSS 3.1 score is 8.3 (high severity), reflecting the significant confidentiality and integrity impact with low attack complexity and no user interaction required.

This vulnerability is fixed in itflow version 26.07. Users should upgrade to version 26.07 or later to remediate this issue. No other mitigation actions are indicated or necessary according to the available data.