Which versions of LMS are affected by CVE-2026-40455?

LMS (LAN Management System) contains a SQL injection vulnerability (CVE-2026-40455, CVSS 8.6) that allows authenticated users to extract sensitive database contents.. A patch is available.

How to fix or mitigate CVE-2026-40455?

Within 24 hours: Identify all systems running LMS and determine which run versions prior to commit 4cb30a7. Within 7 days: Apply the vendor-released patch (commit 4cb30a7 or later) to all affected LMS instances after testing in a staging environment. Within 30 days: Conduct an access review of user accounts with LMS privileges and implement application-level logging on the tarifflist.php module to detect exploitation attempts.

LMS CVE-2026-40455

Q: What is the CVSS score of CVE-2026-40455?

CVE-2026-40455 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37874 HIGH

SQL Injection (CWE-89)

2026-06-18 CERT-PL

GHSA-qrw9-xj5g-qxw8

PHP SQLi Lms

8.6

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Adjacent operator LAN access (AV:A), authenticated low-priv operator (PR:L), no user interaction; error-based SQLi yields full read/write of app DB (C:H/I:H) with limited availability impact (A:L).

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 12:30 vuln.today

Analysis Generated

Jun 18, 2026 - 12:30 vuln.today

DescriptionCVE.org

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode()", allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

AnalysisAI

Error-based SQL injection in LMS (LAN Management System) before commit 4cb30a7 allows authenticated attackers to extract sensitive database contents via the tarifflist.php module. The flaw stems from unsanitized concatenation of the POST tg[] array into a SQL query through implode(), and a CERT-PL-coordinated fix is upstream. No public exploit identified at time of analysis.

Technical ContextAI

LMS (LAN Management System, lms.org.pl) is an open-source PHP-based ISP/network management platform used by operators to manage customers, tariffs, and billing. The vulnerable code in modules/tarifflist.php inside GetTariffList() passed the user-controlled tg[] array directly to implode() and concatenated the result into a SQL WHERE/IN clause, an archetypal CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) pattern. Because tariff group IDs are expected to be integers but were never cast or whitelisted, attackers could break out of the integer list context and append arbitrary SQL fragments that the DBMS surfaces through error messages, enabling error-based extraction.

RemediationAI

Upstream fix available (commit 4cb30a7); released patched version not independently confirmed - operators should pull commit 4cb30a70e7e3d8a0ea53afa2dbef19d5243d449b from https://github.com/chilek/lms or any subsequently tagged release that contains it, which adds Utils::filterIntegers($tags) to coerce tg[] entries to integers in modules/tarifflist.php. As a workaround until deployment, restrict access to the tarifflist.php endpoint via web-server ACLs or remove tariff-list privileges from non-administrative operator roles (trade-off: legitimate operators lose the tariff browse view), and place a WAF/reverse-proxy rule that rejects tg[] values not matching ^[0-9]+$ on POST requests (trade-off: bypassable if request format changes between LMS versions). Review database logs for prior anomalous queries from operator sessions and rotate any credentials, API keys, or customer secrets stored in the LMS database that an attacker could have exfiltrated.