CVE-2026-108107
PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 9, 2026
- Updated
- Oct 9, 2026
- Reserved
- Oct 9, 2026
Description
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
phpnuxbillhotspotbilling |
|
References
- GitHub Security Advisory (GHSA-q8ch-r8cv-q579)vendor-advisory
- https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277technical-description
- https://github.com/hotspotbilling/phpnuxbillproduct
- VulnCheck Advisory: PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.phpthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.