Executive brief
LMS (LAN Management System) is an open-source application used for managing local area networks. A security flaw in its web interface allows an attacker to trick an authenticated user into clicking a malicious link, which then executes unauthorized code in the user's browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 'dbrecover.php' and 'netremap.php' modules of LMS (LAN Management System). The root cause is the failure to sanitize GET parameters (specifically the 'db' parameter in dbrecover.php) before embedding them directly into the HTML output. An attacker can exploit this by inducing an authenticated user to visit a specially crafted URL. Successful exploitation requires certain preconditions, such as a defined network existing in the system, and allows for arbitrary JavaScript execution in the victim's browser. The issue was addressed in commit 9c5651b by implementing htmlspecialchars() escaping.
Affected products
- LMS Developers LMS (LAN Management System) before commit 9c5651b
Timeline
- 2026-06-18: disclosed: Vulnerability disclosed by CERT.PL
- 2026-06-18: advisory: NVD published CVE-2026-40457