CVE-2026-108107

Summary

A critical SQL injection vulnerability exists in PHPNuxBill's FreeRADIUS REST endpoint that allows unauthenticated attackers to extract customer data and credentials through time-based blind SQL injection by manipulating username, MAC address, or NAS ID parameters.

Exploitability

Exploitation is straightforward with no authentication required, needing only a single HTTP request to the affected radius.php endpoint with crafted parameters to trigger the blind SQL injection.

Blast radius

The vulnerability could impact all users of PHPNuxBill versions up to 2025.3.20 who have FreeRADIUS integration enabled, potentially exposing sensitive customer information and authentication credentials across multiple accounts.

Detection

Monitor for unusual patterns in the radius.php endpoint access logs, particularly requests with malformed or suspicious parameter values in username, macAddr, or nasid fields that result in extended processing times, which may indicate time-based blind SQL injection attempts.

Prioritized remediation

Upgrade to version 2025.3.21 or later immediately to address this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.