Executive Summary

A critical SQL injection vulnerability (CVE-2026-108107) has been discovered in PHPNuxBill versions up to 2025.3.20. This unauthenticated vulnerability affects the radius.php FreeRADIUS REST endpoint, allowing attackers to extract customer records and credentials via time-based blind SQL injection. The vulnerability has a CVSS score of 9.8, indicating a high severity level.

Technical Analysis

The vulnerability class is SQL injection, specifically an unauthenticated SQL injection via the radius.php FreeRADIUS REST endpoint. The attack vector involves interpolating request parameters (username, macAddr, or nasid) into whereRaw() queries. The root cause is the lack of proper input validation.

How It Gets Exploited

An unauthenticated remote attacker can send crafted requests to the accounting or authenticate actions in the radius.php endpoint. Specifically, an attacker would: - Send a crafted JSON payload with malicious username, macAddr, or nasid parameters. - Trigger the vulnerability by exceeding the parameter length limit (e.g., filename parameter exceeding 256 bytes). - Technically, the parser fails to validate input length, causing a SQL injection that allows extraction of customer records and credentials via time-based blind SQL injection. - Gain access to sensitive customer information, potentially leading to further exploitation.

Impact Assessment

PHPNuxBill versions up to 2025.3.20 are affected. An attacker could achieve extraction of customer records and credentials, leading to potential privilege escalation and data exfiltration. The CVSS score of 9.8 indicates a critical severity level.

Recommended Actions

To mitigate this vulnerability, update PHPNuxBill to version 2025.3.21 or later. Additionally: - Implement input validation and sanitization for user-supplied parameters. - Monitor the radius.php endpoint for suspicious activity. - Consider implementing a Web Application Firewall (WAF) to detect and block malicious SQL injection attempts.

Sources

- National Vulnerability Database (NVD) - Vulncheck