---
id: CVE-2026-108107
title: >-
  PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection
  vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates
  request parameters into whereRaw() queries
summary: >-
  PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection
  vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates
  request parameters into whereRaw() queries. Attackers can send crafted
  username, macAddr or…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
published: '2026-10-09'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T16:45:01.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108107'
references:
  - url: 'https://github.com/hotspotbilling/phpnuxbill'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-10-09T16:02:33.384Z'
epss: 0.00411
epssPercentile: 0.35479
vendor: hotspotbilling
product: phpnuxbill
affected:
  - phpnuxbill <= 2025.3.20
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-09T14:46:45.760913Z'
---

## Overview

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.