Vulnerabilities in LMS software

CERT Polska has received a report about vulnerabilities in LMS (LAN Management System) software and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-40455: An SQL Injection vulnerability exists in LMS (LAN Management System) before commit4cb30a7within thetarifflist.phpmodule due to insufficient sanitization of the POSTtg[]parameter. The application directly concatenates user-supplied array values into an SQL query usingimplode(), allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

The vulnerabilityCVE-2026-40456: An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit9fcb4dedue to an IP address parameter being passed to theexec()function without proper validation, allowing attackers to execute arbitrary operating system commands.

The vulnerabilityCVE-2026-40457: A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit9c5651bin thedbrecover.phpandnetremap.phpmodules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.

We thank Tymoteusz Dominik for the responsible vulnerability report.