ITFlow CVE-2026-54597

Requires an authenticated ITFlow account holding module_support write permission AND access to a credential record, then invocation of the share_generate_link handler in agent/ajax.php. The concrete flaw: the 'expires' GET parameter is only string-context escaped by sanitizeInput but is inserted UNQUOTED into the 'item_expire_at = NOW() + INTERVAL + $item_expires' MySQL expression in the shared_items INSERT, so a crafted expression plus interval unit executes conditional queries whose results leak via response-time differences. Limiting factors: exploitation is authenticated (not anonymous), needs the specific module_support write role rather than any low-privilege login, is a time-based BLIND channel (slow, latency-inferred, no direct data return), and affects only ITFlow versions prior to 26.07. Exploitation is not possible on default configurations without the module_support write grant and credential-record access.

CVSS 3.1 base 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) rates this High, but the real-world profile is more constrained than the raw number suggests. Exploitation requires PR:L - an authenticated ITFlow user who additionally holds module_support write permission AND access to a specific credential record, so this is a privileged insider / compromised-support-account escalation, not an anonymous internet threat. No EPSS score, SSVC decision data, or POC availability was supplied in the intelligence, and there is no CISA KEV entry, so this is 'no public exploit identified at time of analysis.' However, the vendor security advisory (GHSA-m63v-j7fw-hq2h) plus the fixing commit (63d86917) provide a precise, near-recipe root cause: the expires GET parameter is passed through sanitizeInput (string-context escaping only) then inserted UNQUOTED into a MySQL INTERVAL expression, so classic string escaping is bypassed entirely - the diff replacing sanitizeInput with intval() confirms the injection point and makes weaponization straightforward for anyone reading the patch. Net: a real, patch-diff-verified SQLi worth prioritizing where module_support write is delegated broadly, but the PR:L gate and time-based blind (slow, low-bandwidth) extraction temper the vendor's I:H/A:L impact claim. The 'Hashicorp' tag is spurious - the 'encrypted vault data' referenced is ITFlow's own credential vault, not HashiCorp Vault.

A support-tier ITFlow user (or an attacker who has phished/compromised such an account) opens a client credential record and invokes the share_generate_link handler in agent/ajax.php, supplying a crafted value in the expires parameter that breaks out of the unquoted INTERVAL expression. By embedding conditional time-delay subqueries (e.g. SLEEP-based branches) and observing HTTP response latency, they perform time-based blind extraction of password hashes, SMTP credentials, API keys, encrypted vault contents, and database metadata, then crack the recovered hashes offline to seize administrative control. No public POC was provided, but the fixing commit diff plainly exposes the vulnerable INSERT statement and the missing integer coercion.