CVE-2026-33734
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
FOSSBilling versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the Massmailer module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query.
Risk Assessment
The risk involves potential unauthorized database access, customer data leakage, or modification of sensitive information by an administrator with access to the Massmailer module.
Recommendation
Immediately upgrade to version 0.8.0. If upgrading is not possible, restrict administrator access to trusted users only, disable the Massmailer module if not required, and audit existing records in the mod_massmailer table for suspicious filter values.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.