PHPNuxBill radius.php Vulnerability Allows Unauthenticated Data Theft via SQL Injection

PHPNuxBill, a billing platform for internet service providers, contains a critical security flaw in its FreeRADIUS integration that allows unauthenticated attackers to steal sensitive customer information. The vulnerability resides in the `radius.php` endpoint and involves improper handling of user-supplied input in SQL queries, specifically classified as SQL injection (CWE-89).

Root cause

The issue stems from how the application processes request parameters in the `radius.php` file. According to the National Vulnerability Database (NVD), the endpoint interpolates incoming parameters directly into `whereRaw()` queries without adequate sanitization or parameterization. This design flaw allows malicious input to alter the structure of the underlying database commands, bypassing intended logic controls.

Attack path

Attackers do not need valid login credentials to exploit this vulnerability. By sending crafted requests to the `accounting` or `authenticate` actions, they can manipulate specific parameters such as `username`, `macAddr`, or `nasid`. The exploit relies on time-based blind SQL injection techniques. Instead of returning data directly in the response, the attacker infers information by measuring the time it takes for the server to process queries. This method allows them to extract customer records and credentials bit by bit, making the attack difficult to detect through standard monitoring.

Affected versions

The vulnerability impacts PHPNuxBill (also known as HotspotBilling) versions up to 2025.3.20. Any deployment running these versions or earlier is considered at risk. The NVD record identifies the specific CVE as CVE-2026-108107.

Mitigation

• Verify if your PHPNuxBill installation is version 2025.3.20 or older.
• Monitor server logs for unusual query execution times or repeated requests to `radius.php`.
• Restrict network access to the FreeRADIUS endpoint to trusted internal networks only.
• No official patch or fix has been confirmed yet; consult the vendor for updates.

Background: SQL injection

SQL injection occurs when untrusted input alters database commands. You remain vulnerable when you concatenate strings, ignore parameterized queries, or trust hidden form fields. Fix these errors by using prepared statements, validating input types, and applying least privilege to database accounts. These steps block most injection attempts.

Read the full guide: SQL Injection Mistakes That Leave Your Database Exposed

What to do and how to stay safe: PHPNuxBill

• Inventory all systems running PHPNuxBill or similar billing software to determine exposure levels.
• Implement strict network segmentation to ensure the FreeRADIUS endpoint is not accessible from the public internet.
• Enable detailed logging on database servers to detect anomalous query patterns indicative of blind injection attempts.
• Once the vendor provides an update, prioritize patching affected installations immediately.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108107?

It is a critical unauthenticated SQL injection vulnerability in PHPNuxBill’s FreeRADIUS endpoint that allows data extraction via blind injection techniques.

Which versions of PHPNuxBill are affected?

All versions up to and including 2025.3.20 are affected by this vulnerability.

Do attackers need a user account to exploit this?

No, the vulnerability is unauthenticated, meaning attackers can exploit it without valid login credentials.