CVE-2026-108107 | BDVDB-2026-385180 Detail
hotspotbillingphpnuxbill
Description#
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References#
- https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579
- https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277
- https://github.com/hotspotbilling/phpnuxbill
- https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.