iltosec/cve-2026-54596Proof-of-concept exploit for CVE-2026-54596: authenticated SQL injection in ITFlow's recurring_invoice_frequency parameter enabling full database exfiltration of admin hashes and credentials.
Severity: High
Advisory: GHSA-f9m3-qjc9-v27j
Fixed in: Commit 7211426
Author: iltosec
An SQL injection vulnerability in ITFlow's recurring invoice creation endpoint allows any authenticated user with the Technician role to exfiltrate arbitrary data from the database. A Technician who has access to at least one client invoice can extract admin password hashes, SMTP credentials, and all user account data in a single HTTP request -without any admin interaction.
This is an authenticated vulnerability. The minimum required role is Technician
Full write-up: CVE-2026-54596: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
python exploit.py http://itflow.com [email protected] 'emsJ_;PD@@;-r>4' 2 --all
