Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-54597 — CVE-2026-54597 - Authenticated Time-Based Blind SQL Injection in ITFlow | Kitploit
Tools/GitHubGitHub/iltosec/cve-2026-54597
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubiltosec/cve-2026-54597

CVE-2026-54597

CVE-2026-54597 - Authenticated Time-Based Blind SQL Injection in ITFlow

View Repository
2 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection

Severity: High
Advisory: GHSA-m63v-j7fw-hq2h
Affected: ITFlow (agent/ajax.php — expires parameter)
Fixed in: Commit 63d8691
Author: iltosec

Summary

A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The expires GET parameter is passed directly into a MySQL INTERVAL expression without numeric validation, allowing authenticated users to exfiltrate arbitrary data from the database.

Full write-up: CVE-2026-54597: Authenticated Time-Based Blind SQL Injection in ITFlow

Usage

root@kitploit:~
python exploit.py http://itflow.com [email protected] 'emsJ_;PD@@;-r>4' 1
image
Download Tool