EUVD-2026-41945Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin function with low complexity; PR:H required per description; confirmed confidentiality-only impact from read-path SQL injection.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the Massmailer module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the Massmailer module if it is not required, audit existing records in the mod_massmailer table for suspicious filter values, and/or review administrator activity related to Massmailer message updates.
AnalysisAI
SQL injection in FOSSBilling's Massmailer module exposes the application database to read access by authenticated administrators who can supply crafted filter values during mass email message updates. Affected versions span 0.6.0 through 0.7.2, with the fix shipped in version 0.8.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality impact (VC:H per CVSS 4.0) means a malicious or compromised administrator account could extract sensitive billing and client data from the underlying database.
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client management platform (CPE: cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*). The Massmailer module allows administrators to compose and send bulk email campaigns to filtered recipient sets. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): filter values supplied by the administrator when updating a mass email message are interpolated directly into the SQL recipient selection query without parameterization or escaping. This is a classic string-concatenation SQL injection pattern where attacker-controlled input reaches the database engine unmodified, enabling manipulation of the query's logic and structure. Because the injection point is within a SELECT-class query for recipient selection, the primary confirmed impact is unauthorized database read access (VC:H), consistent with the CVSS 4.0 vector's VI:N/VA:N ratings.
RemediationAI
The primary remediation is upgrading to FOSSBilling version 0.8.0, which patches the SQL injection in the Massmailer module per the vendor advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899. If an immediate upgrade is not feasible, the vendor identifies three compensating controls: first, disable the Massmailer module entirely if bulk email functionality is not required - this removes the vulnerable code path with no functional impact to other billing operations; second, restrict administrator account access to trusted, identifiable users only, reducing the pool of principals who could exploit the flaw; third, audit existing records in the mod_massmailer database table for suspicious or anomalous filter values to detect potential prior exploitation. Organizations should treat the module disable as the strongest available workaround, as restricting admin access addresses the privilege barrier but does not eliminate the underlying injection flaw.
More in Fossbilling
View allSQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated critical severity (CVSS 9.8), this vuln
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated high
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated high severity (CVSS 7.5), this
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated high severity (CVSS 7.2), this vulnera
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 6.5), thi
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. Rated medium severit
Authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x allows unauthenticated remote attackers to invoke privi
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Rated critical severity (CV
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 5.7), thi
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium sev
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated medium severity (CVSS 5.4), this vul
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today