FOSSBilling is a free, open‑source billing and client management system. Versions 0.6.10 through 0.7.2 contain a PHP code injection vulnerability in the Config::prettyPrintArrayToPHP() method. When configuration values are updated, string values are written into config.php without escaping single quotes. Because config.php is loaded via a bare include on every HTTP request, an attacker with administrative privileges can inject arbitrary PHP code that executes on each subsequent request. The likely attack vector is an authenticated session with admin privileges used to modify configuration, and based on the description, it is inferred that this flaw, classified as CWE‑94, allows remote code execution on the host.

Affected products are FOSSBilling releases between 0.6.10 and 0.7.2 inclusive. The vendor provided 0.8.0 that corrects the serialization logic. Administrators should verify their installed version and ensure they are running the patched release or later.

The CVSS score of 8.9 indicates high severity. The EPSS score of <1% indicates a very low but non‑zero exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attacker requires admin privileges to modify configuration values, typically via the web interface; once privileged, the attacker can inject code that runs on every request, leading to remote code execution on the host.