CVE-2026-33734 Details
Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.
A SQL injection vulnerability has been identified in the FOSSBilling client management system, specifically within the Massmailer module's filter functionality. This issue affects versions 0.6.0 through 0.7.2. The vulnerability allows authenticated administrators to inject untrusted input into SQL queries by crafting specific filter values when updating mass email messages. The flawed recipient selection query in the Massmailer module fails to properly parameterize the input, leaving the application open to SQL injection attacks. Version 0.8.0 addresses this vulnerability.
Users are advised to update to FOSSBilling version 0.8.0, which patches this vulnerability. If an immediate update is not possible, administrators can restrict access to the Massmailer module, audit existing records for suspicious filter values, and review administrator activity related to Massmailer updates.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |