{"id":"CVE-2026-108107","published":"2026-10-09T15:17:11.713","lastModified":"2026-10-09T16:45:01.980","description":"PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hotspotbilling/phpnuxbill","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579","tags":[]}],"exploitRefs":[{"url":"https://github.com/hotspotbilling/phpnuxbill","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579","tags":[]}],"hasPoc":true,"ai":{"summary":"A critical SQL injection vulnerability exists in PHPNuxBill's FreeRADIUS REST endpoint that allows unauthenticated attackers to extract customer data and credentials through time-based blind SQL injection by manipulating username, MAC address, or NAS ID parameters.","exploitability":"Exploitation is straightforward with no authentication required, needing only a single HTTP request to the affected radius.php endpoint with crafted parameters to trigger the blind SQL injection.","blast_radius":"The vulnerability could impact all users of PHPNuxBill versions up to 2025.3.20 who have FreeRADIUS integration enabled, potentially exposing sensitive customer information and authentication credentials across multiple accounts.","remediation":"Upgrade to version 2025.3.21 or later immediately to address this SQL injection vulnerability.","detection":"Monitor for unusual patterns in the radius.php endpoint access logs, particularly requests with malformed or suspicious parameter values in username, macAddr, or nasid fields that result in extended processing times, which may indicate time-based blind SQL injection attempts.","tags":["sql-injection","radius","freeradius","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:44.035Z"}}