Description
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Published: 2026-10-09
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote unauthenticated SQL injection leading to data disclosure
Action: Immediate Patch
AI Analysis

Impact

This vulnerability resides in the radius.php FreeRADIUS REST endpoint of PHPNuxBill 2025.3.20 and earlier. The endpoint accepts username, macAddr, and nasid parameters and directly interpolates them into whereRaw() queries. An attacker can send crafted values to the accounting or authenticate actions, performing time‑based blind SQL injection to extract customer records and credentials. The vulnerability is of type CWE‑89 and can result in full disclosure of sensitive user data.

Affected Systems

Deployments running PHPNuxBill version hotspotbilling:phpnuxbill 2025.3.20 or earlier. The patch introduced in later releases removes the vulnerable code, so newer versions are not affected.

Risk and Exploitability

The CVSS score is 9.3, which indicates critical severity. EPSS is not available, so the exact likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a simple unauthenticated HTTP request to the radius.php endpoint, meaning any network host can exploit it without prior access.

Generated by OpenCVE AI on October 9, 2026 at 15:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a PHPNuxBill release newer than 2025.3.20 that removes the unsanitized interpolation in radius.php.
  • If an upgrade is not feasible, modify radius.php to use prepared statements or parameterized queries for handling username, macAddr, and nasid values.
  • Restrict access to the FreeRADIUS REST endpoint by configuring the web server or firewall to accept requests only from trusted internal IP ranges or authenticated users.

Generated by OpenCVE AI on October 9, 2026 at 15:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Hotspotbilling
Hotspotbilling phpnuxbill
Vendors & Products Hotspotbilling
Hotspotbilling phpnuxbill

Fri, 09 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Title PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Hotspotbilling Phpnuxbill
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-09T14:46:56.077Z

Reserved: 2026-10-09T13:44:40.883Z

Link: CVE-2026-108107

cve-icon Vulnrichment

Updated: 2026-10-09T14:46:23.126Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T15:17:11.713

Modified: 2026-10-09T16:45:01.980

Link: CVE-2026-108107

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T12:26:42Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')