CVE-2026-33734: FOSSBilling Massmailer SQLi Vulnerability

CVE-2026-33734 Overview

CVE-2026-33734 is a SQL injection vulnerability in FOSSBilling, a free and open-source billing and client management system. The flaw resides in the Massmailer module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message. These values are interpolated directly into the recipient selection query without sanitization, enabling arbitrary SQL execution against the underlying database.

Versions 0.6.0 through 0.7.2 are affected. Version 0.8.0 patches the issue. The vulnerability is categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the FOSSBilling database, exposing confidential customer, billing, and credential data.

Affected Products

FOSSBilling 0.6.0 through 0.7.2
FOSSBilling Massmailer module
mod_massmailer database table records

Discovery Timeline

2026-07-06 - CVE-2026-33734 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-33734

Vulnerability Analysis

The vulnerability affects the Massmailer module in FOSSBilling, which handles bulk email campaigns to customers. When an administrator updates a mass email message, the module accepts filter values that define recipient selection criteria. These filter values are passed to the recipient selection query without parameterization or proper escaping.

Because the filter input is interpolated directly into the SQL statement, an authenticated administrator can inject SQL syntax that alters the query. This enables reading arbitrary tables, extracting sensitive billing and client data, or manipulating stored records. The mod_massmailer table becomes the storage location for the malicious payload, so the injection can persist between sessions.

Exploitation requires high privileges (administrator authentication), which limits scope but does not eliminate risk. Compromised admin credentials, insider threats, or a chained lower-privilege flaw can all reach this code path.

Root Cause

The root cause is unsafe concatenation of untrusted input into SQL queries within the Massmailer filter handling logic. The module trusts administrator-supplied filter values and omits the use of prepared statements or an ORM-level parameter binding for the recipient selection query.

Attack Vector

The attack vector is network-based over the FOSSBilling administrative interface. An authenticated administrator submits a modified mass email update request containing SQL metacharacters in the filter field. The server processes the request, embeds the payload into the recipient query, and executes it against the database. See the FOSSBilling GitHub Security Advisory GHSA-jf7m-j359-2899 for technical details.

Detection Methods for CVE-2026-33734

Indicators of Compromise

Entries in the mod_massmailer table with SQL metacharacters, UNION SELECT syntax, or comment sequences such as -- and /* inside filter fields.
Unexpected administrator activity related to Massmailer message create or update operations outside normal working hours.
Database error log entries referencing the recipient selection query used by the Massmailer module.

Detection Strategies

Review web server access logs for POST and PUT requests to Massmailer administrative endpoints containing encoded SQL syntax.
Query the mod_massmailer table for records whose filter columns contain characters outside the expected value set for recipient criteria.
Correlate administrator session activity with database query logs to identify anomalous recipient selection queries.

Monitoring Recommendations

Enable MySQL or MariaDB general query logging on the FOSSBilling database during investigation windows to capture injected payloads.
Alert on any modification to mod_massmailer records and require review by a second administrator.
Track authentication events for FOSSBilling administrator accounts and flag logins from unusual IP ranges.

How to Mitigate CVE-2026-33734

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which contains the patch for the Massmailer SQL injection.
Audit existing entries in the mod_massmailer table for suspicious filter values and remove any injected content.
Rotate FOSSBilling administrator credentials and review recent administrator activity for unauthorized Massmailer changes.

Patch Information

FOSSBilling version 0.8.0 addresses CVE-2026-33734 by fixing the Massmailer filter handling so that recipient selection queries no longer interpolate untrusted input directly into SQL. Refer to the GitHub Security Advisory GHSA-jf7m-j359-2899 for the official fix reference.

Workarounds

Restrict administrator access to trusted users only and remove unused administrator accounts.
Disable the Massmailer module if bulk email functionality is not required in your deployment.
Audit records in the mod_massmailer table for suspicious filter values on a recurring schedule.
Review administrator activity logs related to Massmailer message updates for signs of exploitation.

bash

# Example: audit mod_massmailer filter values for suspicious content
mysql -u fossbilling -p fossbilling -e \
  "SELECT id, updated_at, filter FROM mod_massmailer \
   WHERE filter REGEXP '(UNION|SELECT|--|/\\*|;)';"