CVE-2026-43921— FOSSBilling 代码注入漏洞

FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

对生成代码的控制不恰当(代码注入)

FOSSBilling 代码注入漏洞

fossbilling是fossbilling团队开源的一种高效计费和客户管理方案。 FOSSBilling 0.6.10版本至0.7.2版本存在代码注入漏洞，该漏洞源于在`Config::prettyPrintArrayToPHP()`方法中，将配置值写入`config.php`时未转义单引号，导致具有管理员权限的攻击者可以注入任意PHP代码，并在每次HTTP请求时执行。

N/A

N/A