PHPNuxBill: Unauthenticated SQL injection in radius.php

Summary

PHPNuxBill, a PHP-based billing system for MikroTik hotspot and PPPoE services, contains an unauthenticated SQL injection flaw in the FreeRADIUS REST endpoint radius.php. Crafted username, macAddr or nasid parameters sent to the accounting or authenticate actions are interpolated into database queries. An remote attacker can use time-based blind SQL injection to extract customer records and credentials, without needing a login.

Affected

• PHPNuxBill 0 to 2025.3.20 (according to the CVE record)
• Versions after 2025.3.20 are listed as unaffected by the CNA

Fixed in

Unknown. A commit titled "Fix SQL Injection inside radius.php" exists in the Development branch, but no published fixed release has been confirmed. Check the vendor advisory GHSA-q8ch-r8cv-q579 for the fixed version.

Workaround

• Block external access to radius.php at the web server or firewall
• Allow only the MikroTik and FreeRADIUS sources to reach the endpoint, if operationally feasible
• Ensure the database account used by the application has least privileges

Exploitation

• Pre-authentication and remote; no user interaction required
• CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total
• Not listed in CISA KEV according to a third-party tracker
• EPSS about 0.004
• Public proof of concept: unknown
• In-the-wild exploitation: no evidence found

Our recommendation

• Identify all PHPNuxBill instances and their versions; treat versions up to 2025.3.20 as vulnerable
• Check whether radius.php is reachable from the internet and restrict access now if it is
• Monitor the vendor advisory for a confirmed fixed release and update once available
• If the instance was reachable, plan password resets for customer and admin accounts and rotate database credentials
• Review web and database logs for unusual radius.php requests and abnormal query timing; treat the server as compromised if evidence is found
• Also check related issues CVE-2026-108108 and CVE-2026-108109 in the same product

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-q8ch-r8cv-q579 github.com
• VulnCheck advisory www.vulncheck.com
• radius.php at 2025.3.13 github.com
• PHPNuxBill GitHub repository github.com
• Vulners entry (CVSS, EPSS) vulners.com
• VulDB entry vuldb.com
• Fix commit pull request #453 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:43.