Critical Unauth SQLi in PHPNuxBill FreeRADIUS Puts Orgs at Risk, Enabling Credential Theft via Blind Injection
A critical flaw in PHPNuxBill’s FreeRADIUS module allows attackers to extract credentials via blind SQL injection without authentication.
Key points
- CVE-2026-108107 is rated Critical with a CVSS score of 9.3.
- The vulnerability affects PHPNuxBill versions up to and including 2025.3.20.
- Attackers can exploit crafted parameters in the radius.php endpoint to steal data.
Organisations using PHPNuxBill for hotspot billing face immediate risk from a critical SQL injection vulnerability that allows unauthenticated attackers to extract sensitive customer records. The flaw, tracked as CVE-2026-108107, resides in the FreeRADIUS REST endpoint and enables the theft of credentials through time-based blind SQL injection techniques.
How it unfolded
- Security researchers identified an unauthenticated SQL injection vulnerability in PHPNuxBill.
- The flaw was documented in the National Vulnerability Database with a CVSS score of 9.3.
- Analysis revealed the issue stems from improper sanitisation of request parameters in the radius.php file.
Who is affected
The vulnerability impacts all installations of PHPNuxBill up to version 2025.3.20. According to the NVD record, the weakness is classified under CWE-89 (SQL Injection). The specific attack vector involves the radius.php FreeRADIUS REST endpoint, which interpolates user-supplied parameters directly into whereRaw() database queries. Attackers can target the accounting or authenticate actions by sending crafted values for the username, macAddr, or nasid parameters. This manipulation allows them to perform time-based blind SQL injection to extract customer records and login credentials. The product is developed by Hotspotbilling.
The fix
No patch or update has been confirmed yet. Users of PHPNuxBill versions 2025.3.20 and earlier are advised to monitor official channels for a security release. Until a fix is provided, the risk of data exfiltration remains high for any instance exposed to untrusted networks.
What to do and how to stay safe: PHPNuxBill
- Restrict network access to the PHPNuxBill FreeRADIUS endpoint so that only authorised RADIUS servers can communicate with it.
- Monitor server logs for unusual query patterns or delayed responses that may indicate time-based blind SQL injection attempts.
- Ensure that the application server is not directly accessible from the public internet without additional firewall rules.
- Review current backups to ensure you have a clean restore point in case of a compromise while waiting for a vendor update.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108107?
The vulnerability has a CVSS score of 9.3, which is rated as Critical.
Which versions of PHPNuxBill are vulnerable?
All versions of PHPNuxBill up to and including 2025.3.20 are affected.
How do attackers exploit this vulnerability?
Attackers send crafted username, macAddr, or nasid parameters to the radius.php endpoint to perform time-based blind SQL injection.
