CyberRota Analysis
AI-GeneratedThe FOSSBilling system versions 0.6.0 through 0.7.2 are vulnerable to SQL injection in the `Massmailer` module, allowing authenticated administrators to execute arbitrary SQL queries through crafted filter values. This could lead to unauthorized data access or manipulation, posing a significant risk to the integrity of the database. Organizations using affected versions should prioritize upgrading to version 0.8.0 or implementing recommended workarounds to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.