LMS CVE-2026-40455

Requires an authenticated LMS operator session (PR:L) with permission to reach the tariff list view (modules/tarifflist.php) and adjacent-network reachability to the LMS web UI (AV:A) - typically an operator LAN, management VLAN, or VPN, not the public internet. The attacker must submit the tg[] parameter as a POST array (single-value string submissions bypass the implode() concatenation path), and the backend DBMS must surface query errors to the application for the error-based extraction technique to succeed. No user interaction from another victim is needed, and the deployment is vulnerable in its default configuration prior to commit 4cb30a7.

The CVSS 4.0 score of 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) reflects an adjacent-network, low-complexity, low-privilege attack with high confidentiality and integrity impact - consistent with a back-office ISP application where an authenticated operator (or compromised low-tier account) can read or tamper with the customer/billing database. AV:A rather than AV:N suggests the vendor expects deployments behind operator LANs/VPNs, which limits internet-wide mass exploitation, and no EPSS, KEV, or public PoC is reported, so this is not currently a high-velocity threat. Real-world risk is moderate-to-high for any LMS operator because tariff and customer data are PII/financial, the patch is a one-line integer filter that any attacker reviewing the commit can reverse-engineer, and the PR:L barrier is low in environments with many operator accounts.

An attacker with a low-privilege operator account - obtained through phishing, credential reuse, or insider access - opens the tariff list page and submits a crafted POST request where tg[] contains values like 1) AND extractvalue(...) -- so that implode() inserts the payload directly into the SQL string. The database returns the injected sub-query result inside an error message, letting the attacker iteratively dump customer records, billing data, and operator password hashes; no public PoC is identified, but the fix commit makes the vulnerable parameter trivial to locate.