CVE-2026-108107 in PHPNuxBill
Summary
by MITRE • 10/09/2026
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The PHPNuxBill software suite, specifically versions up through 2025.3.20, contains a critical unauthenticated SQL injection vulnerability located within its FreeRADIUS REST endpoint implementation in the radius.php module. This security flaw arises from improper neutralization of special elements used in an SQL command, commonly categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The root cause lies in how the application processes incoming HTTP requests directed at specific FreeRADIUS actions, namely accounting and authenticate. When these endpoints receive data, they directly interpolate user-supplied parameters such as username, macAddr, or nasid into database query structures without adequate sanitization or parameterized query usage. This architectural oversight allows an attacker to inject malicious SQL logic directly into the application's backend processing pipeline.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the specific mechanism employed for exploitation. Attackers do not require valid credentials to initiate an attack, meaning any external actor with network access to the service can attempt exploitation. The primary method identified involves time-based blind SQL injection techniques. By crafting precise payloads within the username, macAddr, or nasid fields, attackers can manipulate the database query execution timing. This allows them to infer information about the underlying database structure and extract sensitive data incrementally. Because this is a blind injection, there may be no direct error messages returned in the HTTP response, but the application's behavior changes based on whether the injected condition evaluates to true or false, enabling systematic data extraction over time.
The consequences of successful exploitation include the unauthorized access to customer records and authentication credentials stored within the PHPNuxBill database. This exposure compromises the confidentiality of personally identifiable information (PII) belonging to end-users as well as sensitive administrative or user account details. The compromise of these credentials can lead further into lateral movement, allowing attackers to impersonate legitimate users, disrupt network services managed by FreeRADIUS, or access other systems that rely on the same authentication infrastructure. This aligns with ATT&CK technique T1059: Command and Scripting Interpreter for payload delivery and potentially T1078: Valid Accounts if extracted credentials are used for further unauthorized access.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The most effective solution is to upgrade PHPNuxBill to a version where this vulnerability has been patched, ensuring that the radius.php module properly implements parameterized queries or prepared statements instead of direct string interpolation for all database operations involving user input. For systems unable to immediately patch, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block SQL injection patterns in HTTP requests targeting the FreeRADIUS endpoints. Additionally, implementing strict input validation that rejects unexpected characters or formats in username, macAddr, and nasid fields can reduce the attack surface. Regular security audits focusing on database interaction layers are recommended to prevent similar CWE-89 vulnerabilities from being introduced into other parts of the application logic.