CyberRota Analysis
AI-GeneratedFOSSBilling versions 0.6.10 through 0.7.2 are vulnerable to a PHP code injection flaw in the `Config::prettyPrintArrayToPHP()` method, allowing attackers with admin privileges to inject arbitrary PHP code into `config.php`. This code executes on every HTTP request, potentially compromising the entire application. Organizations using affected versions should prioritize immediate upgrades to version 0.8.0 or implement available workarounds, especially those with administrative access to the system.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.