PHPNuxBill EUVD-2026-95808

Exploitation requires network access to the PHPNuxBill radius.php FreeRADIUS REST endpoint and that this endpoint be reachable by the attacker (typically deployed to serve FreeRADIUS accounting/authenticate requests). The specific injectable inputs are the username, macAddr, and nasid request parameters passed to the 'accounting' or 'authenticate' actions, which are interpolated into whereRaw() queries. No authentication is required (PR:N) and no special non-default feature toggle is named in the description - any deployment running radius.php through version 2025.3.20 with the endpoint exposed is affected. The primary limiting factor is endpoint exposure: if radius.php is restricted to the trusted RADIUS/NAS network segment rather than internet-facing, the realistic attack surface is substantially reduced.

This is a genuine high-priority issue, not a CVSS-inflated paper tiger. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the worst-case exposure profile: network-reachable, low-complexity, no authentication, and no user interaction - meaning any attacker who can reach the radius.php endpoint can attempt exploitation directly. The vulnerability class (CWE-89 SQL injection via whereRaw() string interpolation) is well-understood and reliably exploitable, and the reporting organization (VulnCheck) is a credible intelligence source with a dedicated advisory. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or automated weaponization at this time - the risk is driven by inherent exploitability rather than observed in-the-wild activity. One caveat worth verifying: the description characterizes the flaw as time-based BLIND SQL injection used to EXTRACT records, which implies a confidentiality-dominant impact, yet the supplied CVSS 4.0 vector rates integrity and availability as High (VI:H/VA:H). That full-triad High rating would require stacked/modifying queries that the description does not explicitly confirm - treat the integrity/availability impact as unverified and confirm with the vendor advisory. Net assessment: real and actionable due to unauthenticated network reach, but currently exploitation-status quiet (no KEV/POC/EPSS signal).

A remote, unauthenticated attacker locates an internet-exposed PHPNuxBill FreeRADIUS integration endpoint (radius.php) and sends crafted username, macAddr, or nasid parameters to the accounting or authenticate actions. Because these values are interpolated into whereRaw() queries, the attacker uses time-based blind SQL injection to incrementally extract customer records and stored credentials from the billing database. No public exploit code was identified in the provided data, but the technique is standard and automatable with tools like sqlmap.