PT-2026-3025 · Itflow · Itflow

Publicado 2026-01-15 · Atualizado 2026-01-17 · CVE-2025-67081

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Itflow versions through 25.06

Description An SQL injection issue exists in Itflow due to insufficient sanitization of integer parameters. Specifically, the "role id" parameter is vulnerable when editing a profile. An attacker with administrative privileges can exploit this through blind SQL injection to extract arbitrary data from the database. The vulnerable parameter is role id.

Recommendations Versions prior to 25.06 should be updated. Ensure proper sanitization of the role id parameter when editing profiles.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-67081

Produtos afetados

Itflow

Referências · 5

• https://github.com/itflow-org/itflow · Nota
• https://helx.io/blog/advisory-itflow · Nota
• https://osv.dev/vulnerability/CVE-2025-67081 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-67081 · Nota de Segurança
• https://twitter.com/CVEnew/status/2012490389605736760 · Publicação no Twitter