CVE-2026-33734
Received Received - Intake

SQL Injection in FOSSBilling Massmailer Module

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-07
AI Q&A
2026-07-07
EPSS Evaluated
N/A
NVD
CVE-2026-33734

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fossbilling fossbilling From 0.6.0 (inc) to 0.7.2 (inc)
fossbilling fossbilling 0.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in FOSSBilling versions 0.6.0 through 0.7.2 within the Massmailer module's filter functionality. An authenticated administrator can supply specially crafted filter values when updating a mass email message. These crafted inputs are directly interpolated into an SQL query used to select recipients, leading to a SQL injection vulnerability.

Impact Analysis

The SQL injection vulnerability allows an authenticated administrator to manipulate the database queries executed by the Massmailer module. This could lead to unauthorized access to or modification of database information, potentially compromising data integrity and confidentiality.

Detection Guidance

This vulnerability can be detected by auditing existing records in the `mod_massmailer` table for suspicious filter values and reviewing administrator activity related to `Massmailer` message updates.

Since the vulnerability involves crafted filter values being interpolated into SQL queries, checking database entries and logs for unusual or unexpected filter inputs is recommended.

No specific commands are provided in the available information.

Mitigation Strategies
  • Restrict administrator access to trusted users only.
  • Disable the `Massmailer` module if it is not required.
  • Audit existing records in the `mod_massmailer` table for suspicious filter values.
  • Review administrator activity related to `Massmailer` message updates.

Additionally, upgrade to version 0.8.0 or later, where the issue is patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart