CVE-2026-108107
CriticalCVSS 9.8Summary
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Risk Assessment
An attacker can extract customer records and credentials from the database, potentially leading to further attacks and a breach of data confidentiality.
Recommendation
Update PHPNuxBill to a version later than 2025.3.20. Apply query parameterization and input validation in the radius.php endpoint.
Other vulnerabilities in PHPNuxBill
See all- CVE-2026-108108High
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
- CVE-2026-108109Critical
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php. An unauthenticated attacker can brute-force the 6-digit otp_code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Original NVD description (English source)
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS