← Vulnerabilidades
CVE-2026-108107
Registro da vulnerabilidade com dados oficiais do NIST NVD, CISA KEV e FIRST EPSS.
Descrição
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
- CVSS 3.x
- 9.8 CRITICAL
- Publicada
- 09/10/2026
- Atualizada
- 09/10/2026
- Status NVD
- Deferred
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fraqueza: CWE-89
Exploração
- No catálogo CISA KEV
- Não
- EPSS (FIRST)
- 0.4%
Referências
Links publicados no registro oficial
- https://github.com/hotspotbilling/phpnuxbill
- https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277
- https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579
- https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php
- https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579
Alguns navegadores bloqueiam sites oficiais abertos a partir da pré-visualização; copie o endereço para abrir em outra aba: https://nvd.nist.gov/vuln/detail/CVE-2026-108107