by Kastro
Paper/Archive/CVE-2026-108107

CVE-2026-108107

hotspotbilling phpnuxbill — PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.3.353 × 207.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

Affected

ProductAffectedFixed inSource
phpnuxbill≤ 2025.3.20–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579writeupgithub.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277refgithub.com/hotspotbilling/phpnuxbillwriteupvulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php