Phpnuxbill
Monthly
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Authentication bypass in PHPNuxBill through 2025.3.20 allows attackers on the adjacent network to log in as any customer via MikroTik hotspot or PPPoE CHAP by supplying any incorrect password, provided they know a valid username. This grants unauthorized network access and allows the attacker to consume that customer's plan. No public exploit has been identified at time of analysis, and the vulnerability is rated High severity (CVSS 4.0 base 7.1).
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Authentication bypass in PHPNuxBill through 2025.3.20 allows attackers on the adjacent network to log in as any customer via MikroTik hotspot or PPPoE CHAP by supplying any incorrect password, provided they know a valid username. This grants unauthorized network access and allows the attacker to consume that customer's plan. No public exploit has been identified at time of analysis, and the vulnerability is rated High severity (CVSS 4.0 base 7.1).
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.