Time-based SQLi in PHPNuxBill radius.php enables unauthenticated credential theft

PHPNuxBill contains a critical unauthenticated SQL injection vulnerability in its FreeRADIUS REST endpoint. The flaw, tracked as CVE-2026-108107, allows attackers to extract sensitive customer records and credentials from installations running version 2025.3.20 or earlier.

What happened

The National Vulnerability Database records CVE-2026-108107 as a critical issue with a CVSS score of 9.3. The vulnerability exists within the radius.php file, which serves as the FreeRADIUS REST endpoint for the PHPNuxBill billing platform. According to the NVD description, the application interpolates request parameters directly into whereRaw() database queries. This coding practice creates a pathway for SQL injection attacks that do not require prior authentication.

Attackers can exploit this weakness by sending crafted requests to specific actions within the endpoint. The affected actions include accounting and authenticate functions. By manipulating the username, macAddr, or nasid parameters, an attacker can inject malicious SQL code into the application’s query logic. The NVD specifies that the injection is time-based blind, meaning the attacker infers data by measuring response times rather than seeing direct output errors.

The successful exploitation of this flaw enables the extraction of customer records and stored credentials. Because the endpoint is unauthenticated, any external actor with network access to the service can attempt the attack. The vulnerability affects all versions of PHPNuxBill through 2025.3.20. The NVD lists the affected product as hotspotbilling phpnuxbill.

Why it matters

SQL injection remains one of the most severe web application vulnerabilities due to its potential for complete data compromise. In this case, the lack of authentication requirements significantly lowers the barrier for exploitation. Attackers do not need to compromise user accounts or bypass login screens to target the database. They can interact directly with the vulnerable endpoint from the public internet.

The specific use of time-based blind SQL injection makes detection difficult for standard web application firewalls or intrusion prevention systems. These tools often look for explicit error messages or large data exfiltration patterns. Time-based attacks rely on subtle delays in server responses, which can blend in with normal network latency or slow database performance. This stealthy nature allows attackers to systematically extract data over time without triggering immediate alerts.

The exposure of credentials and customer records poses significant risks to organizations using PHPNuxBill for billing and access control. Compromised credentials can lead to further lateral movement within the network or unauthorized access to other systems. The critical CVSS score of 9.3 reflects the high impact and ease of exploitation associated with this unauthenticated remote code execution vector.

Our take on the response

• Monitor network traffic for unusual delays in responses to the radius.php endpoint.
• Restrict access to the FreeRADIUS REST endpoint to trusted internal networks only.
• Implement strict input validation for username, macAddr, and nasid parameters.
• Audit database logs for signs of time-based query execution patterns.

Background: Unauthorized access

Most teams assume unauthorized access means broken encryption or stolen passwords. In reality, attackers often use valid accounts, legitimate tools, and internal trust relationships. Detection fails because alerts are tuned to look for outsiders, not insiders acting strangely.

Read the full guide: Unauthorized Access Myths: What Detection Actually Misses

What to do and how to stay safe: PHPNuxBill

• Verify if your organization uses PHPNuxBill version 2025.3.20 or earlier and check for updates.
• Restrict external access to the radius.php endpoint using firewall rules or network segmentation.
• Monitor server response times for anomalies that may indicate time-based SQL injection attempts.
• Review database logs for unusual query patterns involving the accounting or authenticate actions.

Step-by-step guide: Web Application Firewall Checklist: Configuration, Logic, and Bypass Prevention

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of PHPNuxBill are affected by CVE-2026-108107?

All versions of PHPNuxBill through 2025.3.20 are affected by this vulnerability.

What type of SQL injection is present in this vulnerability?

The vulnerability involves time-based blind SQL injection in the radius.php endpoint.

Can attackers exploit this flaw without authentication?

Yes, the SQL injection vulnerability in the FreeRADIUS REST endpoint is unauthenticated.