Critical SQL Injection Flaw Found in PHPNuxBill FreeRADIUS Endpoint

A critical security vulnerability has been identified in PHPNuxBill, a billing software solution, allowing unauthenticated attackers to execute SQL injection attacks. The flaw, tracked as CVE-2026-108107, enables adversaries to extract sensitive customer records and credentials without needing valid login credentials.

According to the National Vulnerability Database (NVD), the vulnerability carries a CVSS score of 9.3, classifying it as Critical. The issue stems from improper input validation within the `radius.php` file, which serves as a FreeRADIUS REST endpoint. Specifically, the application interpolates user-supplied request parameters directly into `whereRaw()` queries. This lack of sanitization allows attackers to manipulate the database logic through time-based blind SQL injection techniques.

Technical Details and Attack Vector

The vulnerability affects how PHPNuxBill processes requests sent to its FreeRADIUS integration. Attackers can target specific actions, namely `accounting` and `authenticate`, by sending crafted HTTP requests. By manipulating the `username`, `macAddr`, or `nasid` parameters within these requests, an attacker can inject malicious SQL code.

Because the injection is time-based and blind, the attacker does not receive direct error messages or data dumps in the initial response. Instead, they infer the presence of specific data by measuring the delay in the server's response time. Despite the blind nature of the attack, the NVD record indicates that this method is sufficient for extracting customer records and authentication credentials from the database. The weakness is categorized under CWE-89, which denotes improper neutralization of special elements used in an SQL command.

Who Is Affected

The vulnerability impacts PHPNuxBill installations running versions up to and including 2025.3.20. PHPNuxBill is often used by internet service providers and hotspot operators for billing and network management. Organizations using the software for FreeRADIUS authentication or accounting are at risk if they have not applied any unofficial patches, as no official fix has been confirmed in the source material.

Any deployment where the `radius.php` endpoint is accessible to unauthenticated users is potentially exploitable. Since the attack does not require authentication, external attackers can probe for the vulnerability from the internet if the endpoint is exposed. The ability to extract credentials poses a significant risk to both the service provider and their customers, potentially leading to account takeover or further lateral movement within the network.

What should you do?

Security teams should immediately verify their PHPNuxBill version against the affected range. If the version is 2025.3.20 or earlier, the system is vulnerable. Administrators should monitor network traffic for unusual delays or high-frequency requests to the FreeRADIUS REST endpoints, which may indicate active exploitation attempts. Until a vendor-provided update is available, restricting access to the `radius.php` endpoint via firewall rules or web application firewalls can reduce the attack surface.