CVE-2026-108107 is an unauthenticated SQL injection (CWE-89) in the radius.php endpoint of PHPNuxBill through 2025.3.20, scored 9.8 critical. Request parameters go into raw queries. The GitHub advisory lists no patched version, so block the endpoint to untrusted clients and watch the project for a fix.
What's affected
PHPNuxBill through 2025.3.20, per the CVE record. The researcher wrote the report against 2025.3.13, and the record extends the range through 2025.3.20.
The weakness is in radius.php, the endpoint that FreeRADIUS uses to call PHPNuxBill over REST. The record names the username, macAddr and nasid parameters on the accounting and authenticate actions. The GitHub advisory shows no patched version, so no fix is confirmed. Check the project repository for a newer release before you decide.
How to check if you're exposed
PHPNuxBill is a PHP application, so you will not see it in a package lock file. Find it by looking at your servers.
Look for the application directory and read its version from the project files. Then check whether radius.php is reachable from outside the network that FreeRADIUS lives on. A simple request from a trusted test host will tell you if the path answers.
In your web server logs, search for requests to radius.php from addresses other than your RADIUS server. Time based blind injection leaves a trail of many similar requests with slow responses, so look for bursts against that path.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Restrict
radius.phpat the web server or firewall so that only your RADIUS server address can reach it. - Put the application behind a web application firewall with SQL injection rules, as a stopgap.
- Run the application's database account with the least privilege it needs.
- Review web logs and database audit logs for abnormal use of the endpoint, and rotate customer and admin credentials if you find signs of probing.
- Watch the project for a release that fixes the injection, then upgrade and retest.
Why it matters
The code builds raw query conditions out of request values. This is CWE-89, the classic SQL injection. The record says a blind, time based technique lets an attacker pull out customer records and credentials, which fits the stored data in a billing system for internet service providers.
The endpoint was never meant to face the public. It exists for a single trusted caller. When a machine to machine endpoint has no authentication of its own, network placement is its only protection, and a mistake in firewall rules turns it into an open door.
The record does not flag this CVE as exploited in the wild and it is not a CISA Known Exploited Vulnerability.
Quick check
Is there a patched release?
The GitHub advisory shows none, and the record names the range as through 2025.3.20. Check the project for a newer release.
Why does this score 9.8?
It needs no authentication and no user interaction, and it can expose confidential data. That combination gives a critical base score.
Sources
Last reviewed: 19 October 2026.
