BaseFortify

Executive Summary

PHPNuxBill through 2025.3.20 has an authentication bypass flaw in RADIUS CHAP verification. The Password::chap_verify() function incorrectly returns true even when the provided response does not match the expected password. This allows attackers with knowledge of a valid username to log in via MikroTik hotspot or PPPoE CHAP using any incorrect password, gaining unauthorized network access and consuming the victim's plan.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Password::chap_verify() function in system/autoload/Password.php for inverted comparison logic. Check if the function returns true when the CHAP response does not match the expected value. Verify authentication logs for successful logins with invalid passwords for valid usernames.

Useful 0 Not Useful 0

Impact Analysis

If you use PHPNuxBill for network authentication, attackers could bypass login controls to access your network or consume your paid plan. This may lead to unauthorized data usage, potential data breaches, or financial loss if billing plans are depleted by attackers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, potentially breaching GDPR or HIPAA. Unauthorized network access may lead to data exposure, violating confidentiality and integrity controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update PHPNuxBill to version 2025.3.20 or later to fix the authentication bypass in RADIUS CHAP verification. Disable CHAP authentication for MikroTik hotspot or PPPoE if not required. Monitor network access logs for unusual login attempts with incorrect passwords.

Useful 0 Not Useful 0