CVE-2026-108107: Blind SQLi in PHPNuxBill radius.php Lets Attackers Steal Data via Crafted Parameters

A critical security flaw has been identified in PHPNuxBill, a billing platform used for hotspot and network management. The issue, tracked as CVE-2026-108107, allows unauthenticated attackers to perform SQL injection attacks against the application’s FreeRADIUS interface. According to the National Vulnerability Database (NVD), the vulnerability carries a CVSS score of 9.3, placing it in the critical severity range.

The risk

The vulnerability stems from improper input handling within the `radius.php` file. Specifically, the application interpolates request parameters directly into `whereRaw()` queries without adequate sanitization. This design choice creates a pathway for SQL injection, classified under CWE-89.

Attackers do not need valid credentials to exploit this flaw. By sending crafted requests to the accounting or authenticate actions, they can manipulate the `username`, `macAddr`, or `nasid` parameters. The NVD record notes that the exploitation method involves time-based blind SQL injection. This technique allows an attacker to extract sensitive information, such as customer records and stored credentials, by observing the response times of the application rather than receiving direct data output in the response body.

Who is exposed

The vulnerability affects all versions of PHPNuxBill up to and including 2025.3.20. The software is marketed under the name HotspotBilling. Any deployment running these versions that exposes the FreeRADIUS REST endpoint to the internet or an untrusted network is potentially at risk. Because the attack is unauthenticated, there is no barrier to entry for threat actors scanning for this specific endpoint.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory fines, or compliance implications for organizations affected by this vulnerability.

What should you do?

Managers should immediately audit their network architecture to determine if the PHPNuxBill `radius.php` endpoint is accessible from external networks. If the endpoint is exposed, restrict access via firewall rules to only trusted IP addresses until a patch is available. Monitor server logs for unusual query patterns or delayed responses that may indicate time-based blind injection attempts.

What to do and how to stay safe: PHPNuxBill

• Verify the version of PHPNuxBill installed on your servers to confirm if it is 2025.3.20 or earlier.
• Implement network-level access controls to block external traffic to the FreeRADIUS REST endpoint.
• Monitor application logs for anomalies in request timing or unusual parameter values in radius.php calls.
• Once the vendor provides an update, apply the patch immediately to resolve the SQL injection risk.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108107?

The National Vulnerability Database rates CVE-2026-108107 as Critical with a CVSS score of 9.3.

Which versions of PHPNuxBill are affected by this vulnerability?

All versions of PHPNuxBill through 2025.3.20 are affected by this unauthenticated SQL injection flaw.

How do attackers exploit this vulnerability?

Attackers use time-based blind SQL injection by sending crafted parameters such as username, macAddr, or nasid to the radius.php endpoint.