FOSSBilling is a free, open‑source billing and client management system. Versions 0.6.10 through 0.7.2 contain a PHP code injection vulnerability in the Config::prettyPrintArrayToPHP() method. When configuration values are updated, string values are written to config.php without escaping single quotes. Because config.php is included directly on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on each subsequent request. This flaw, classified as CWE‑94, allows remote code execution on the host. Version 0.8.0 fixes the issue, and temporary mitigations include restricting admin access, auditing config.php for unexpected code, or blocking configuration‑modifying endpoints at the reverse‑proxy or WAF layer.

Affected products are FOSSBilling releases between 0.6.10 and 0.7.2 inclusive. The vendor provided 0.8.0 that corrects the serialization logic. Administrators should verify their installed version and ensure they are running the patched release or later.

The CVSS score of 8.9 indicates high severity. The EPSS score of <1% indicates a very low but non‑zero exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker obtain admin privileges to modify configuration values, typically via the web interface. Once privileged, the attacker can inject code that runs on every request, leading to remote code execution on the host.