Hackers Steal PHPNuxBill Data via Critical CVE-2026-108107 SQLi in Versions up to 2025.3.20

A critical security flaw in PHPNuxBill allows attackers to access sensitive customer information without needing any login credentials. The issue, identified as CVE-2026-108107, resides in the software’s FreeRADIUS REST endpoint. According to the National Vulnerability Database, this vulnerability enables unauthorized users to extract records and credentials by manipulating specific request parameters.

In plain English

PHPNuxBill is a billing and management platform often used by internet service providers and hotspot operators. The flaw lies in how the software handles requests sent to its `radius.php` file, which manages network access via FreeRADIUS.

When an attacker sends a specially crafted request to this endpoint, the software incorrectly processes input fields such as username, MAC address, or NAS ID. Instead of treating these inputs as simple text, the system inserts them directly into database queries. This mistake, known as SQL injection, allows the attacker to trick the database into revealing information it should keep private.

The specific type of attack described is "time-based blind SQL injection." This means the attacker does not see the data directly in the response. Instead, they send commands that make the database pause for a specific amount of time if a condition is true. By measuring these delays, the attacker can reconstruct the contents of the database, including customer records and login credentials, one bit at a time.

The background

The National Vulnerability Database lists CVE-2026-108107 as a Critical severity issue with a CVSS score of 9.3. The weakness is categorized under CWE-89, which refers to Improper Neutralization of Special Elements used in an SQL Command.

The vulnerability affects all versions of PHPNuxBill up to and including 2025.3.20. The affected component is the `whereRaw()` query function within the `radius.php` endpoint. Attackers can target either the `accounting` or `authenticate` actions to exploit this flaw. Because the endpoint is unauthenticated, anyone with network access to the server can attempt to exploit it.

What changes now

Organizations using PHPNuxBill must verify their current version immediately. If the installation is version 2025.3.20 or older, it is vulnerable. Security teams should monitor for unusual traffic patterns directed at the `radius.php` endpoint, particularly requests that cause significant delays in response times, which may indicate an ongoing time-based attack.

Background: SQL injection

Look for unexpected database errors, slow page loads, or logic bypasses. Check logs for tautologies and comment characters. Isolate affected inputs immediately and review parameterized query implementation.

Read the full guide: SQL Injection Warning Signs: Detecting Data Breaches Early

What to do and how to stay safe: PHPNuxBill

• Check your PHPNuxBill version and confirm if it is 2025.3.20 or older.
• Restrict access to the `radius.php` endpoint using firewall rules to allow only trusted network addresses.
• Monitor server logs for unusual delays or repeated requests to the FreeRADIUS REST endpoint.
• Wait for an official patch from the vendor before updating, as no fix has been confirmed yet.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108107?

It is a critical unauthenticated SQL injection vulnerability in PHPNuxBill’s FreeRADIUS endpoint that allows attackers to extract data.

Which versions of PHPNuxBill are affected?

All versions up to and including 2025.3.20 are affected by this vulnerability.

How do attackers exploit this flaw?

Attackers send crafted parameters to the accounting or authenticate actions to perform time-based blind SQL injection.