Executive brief
LAN Management System (LMS), a software suite used by internet service providers to manage networks and customers, contains a security vulnerability in its billing and tariff management module. An authorized user could exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive customer data, financial records, or system configuration information.
Technical details
An SQL injection vulnerability exists in the 'tarifflist.php' module of LAN Management System (LMS) due to improper neutralization of the 'tg[]' POST parameter. The application uses the PHP 'implode()' function to directly concatenate user-supplied array values into an SQL query without sufficient sanitization or parameterization. An authenticated attacker with access to the tariff list can perform error-based SQL injection to extract sensitive data from the database. The issue was addressed in commit 4cb30a7 by implementing integer filtering on the affected tags.
Affected products
- LMS Developers LAN Management System (LMS) before commit 4cb30a7
Timeline
- 2026-06-18: advisory: Advisory published by CERT.PL
- 2026-06-18: patched: Fix identified in commit 4cb30a7