ITFlow EUVD-2026-82469

Requires an authenticated ITFlow account with the Technician role or higher AND access to at least one client invoice, on a version prior to 26.07. The injection is delivered via the 'frequency' POST parameter to agent/post/recurring_invoice.php, which stores recurring_invoice_frequency unquoted inside a DATE_ADD interval expression. No user interaction beyond the attacker's own request is needed for the primary injection; the second-order path additionally requires a legitimate user to invoke 'Force Recurring', which re-runs the persisted payload in a later UPDATE. Limiting factors: the PR:L authentication requirement (no unauthenticated access) and the need for invoice access confine this to insiders or attackers who have already compromised a technician credential.

This is a genuinely exploitable, high-value flaw but not a top-of-queue emergency. The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is credible: network-reachable, low complexity, but requiring an authenticated Technician-or-higher account with access to at least one client invoice (PR:L). That authentication gate is the key limiter - this is not an unauthenticated internet-facing RCE. No EPSS score, KEV listing, or public exploit was supplied, so exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active exploitation or automatability. However, the vendor advisory (GHSA-f9m3-qjc9-v27j), the fixing PR #1284, the exact commit 721142629296ac8e335a79b32fd4d2df721234a8, and the v26.07 release are all confirmed, so the vulnerability and fix are well-substantiated. The impact ceiling is severe: the description states extraction of password hashes, SMTP credentials, user records, and DB metadata plus field modification and administrative takeover after credential cracking - consistent with C:H/I:H. A:N is appropriate since no availability impact is described. The realistic risk is post-authentication privilege escalation / full-database compromise by a lower-privileged insider (or an attacker who has phished/compromised a Technician account), amplified by the second-order vector where a different legitimate user's 'Force Recurring' action re-triggers the stored payload.

An authenticated Technician who can view at least one client invoice submits a crafted 'frequency' value to agent/post/recurring_invoice.php; because the value is passed through sanitizeInput but interpolated unquoted into a DATE_ADD interval, the attacker escapes the expression, appends INSERT columns, and stashes subquery output (e.g. password hashes, SMTP creds) into recurring_invoice_note, then reads it back via agent/recurring_invoice.php. Because the malicious frequency is persisted, a later 'Force Recurring' UPDATE by any legitimate user re-executes the payload as a second-order injection. No public exploit code is identified, but the fixing PR pinpoints the exact vulnerable line, making reproduction straightforward.