CVE-2026-108107criticalCWE-89

CVE-2026-108107: fallo crítico en hotspotbilling phpnuxbill

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

Publicada el

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.4%
probabilidad de explotación
0.4%top 66% de las CVE
explotación observada
noninguna fuente lo reporta
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
hotspotbilling · phpnuxbill
CVEs relacionadas — hotspotbilling phpnuxbill

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-108109CRITICALPHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset CodeEPSS 0.4%CVE-2026-108108HIGHPHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()EPSS 0.2%
Referencias
https://github.com/hotspotbilling/phpnuxbillhttps://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php