LMS software patches three vulnerabilities
CERT Polska coordinated disclosure of SQL injection, OS command injection, and XSS flaws in LAN Management System (LMS) software.
CERT Polska has published details on three vulnerabilities affecting LMS (LAN Management System), an open-source ISP billing and network management platform. The most severe, CVE-2026-40456, is an OS command injection flaw where an IP address parameter is passed unsanitized to exec(), allowing arbitrary command execution. CVE-2026-40455 is an error-based SQL injection in the tarifflist.php module caused by unsafe concatenation of the POST tg[] parameter via implode(), enabling authenticated attackers to extract database contents. CVE-2026-40457 is a reflected XSS issue in the dbrecover.php and netremap.php modules stemming from unsanitized GET parameters.
All three vulnerabilities require authentication or specific conditions (such as a network being defined and a victim clicking a crafted link for the XSS case), which limits mass-exploitation potential but still poses meaningful risk to organizations running LMS for network and subscriber management, typically ISPs and telecom operators. The issues were fixed in specific upstream commits, and the report credits researcher Tymoteusz Dominik for responsible disclosure through CERT Polska's coordinated vulnerability disclosure (CVD) process. No evidence of active exploitation is mentioned in the advisory.
Mentioned in this report
Detection guidance
Web Server Spawning Network Diagnostic Command After LMS Request
Detects a web server / PHP-FPM process spawning a shell that invokes network diagnostic utilities (ping/traceroute/nslookup), consistent with exploitation of an unsanitized IP parameter passed to exec() as in the LMS CVE-2026-40456 command injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Spawning Network Diagnostic Command After LMS Request
description: Detects Apache/Nginx/PHP-FPM worker processes spawning a shell that runs
ping/traceroute/nslookup with an argument, matching the exec() OS command injection
pattern where an unsanitized IP parameter is concatenated into a system command
by ISP/LMS-style management applications.
tags:
- attack.execution
- attack.initial-access
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'ping '
- 'traceroute '
- 'nslookup '
- 'fping '
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legitimate network monitoring plugins that shell out to ping/traceroute for connectivity
checks
- Admin-triggered diagnostics through a web-based management console using the same
binaries
level: high
id: 0d6e693f-633c-5997-98dd-ee29975d340b
status: experimental
author: Vorant
SQL Injection Attempt Against LMS tarifflist.php tg Parameter
Detects HTTP requests to the LMS tarifflist.php endpoint carrying SQL injection payloads in the tg[] POST parameter, matching CVE-2026-40455 error-based SQL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Attempt Against LMS tarifflist.php tg Parameter
description: Detects requests to tarifflist.php where the tg[] parameter (used unsafely
via implode() concatenation) contains classic SQL injection markers, indicating
exploitation attempts of CVE-2026-40455.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: tarifflist.php
selection_param:
cs-uri-query|contains: tg[
selection_payload:
cs-uri-query|contains:
- UNION SELECT
- union select
- ''' OR '''
- ' OR 1=1'
- --+
- SLEEP(
- sleep(
condition: selection_endpoint and selection_param and selection_payload
falsepositives:
- Automated web vulnerability scanners run by the organization's own security team
against LMS
- Penetration testing activity targeting the tarifflist module
level: high
id: 06daf450-930a-5100-8684-7e5c59c1c045
status: experimental
author: Vorant
Reflected XSS Attempt Against LMS dbrecover.php or netremap.php
Detects GET requests to LMS dbrecover.php or netremap.php modules containing script/HTML injection markers, matching CVE-2026-40457 reflected XSS which requires a victim to click a crafted link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against LMS dbrecover.php or netremap.php
description: Detects HTTP GET requests to the vulnerable dbrecover.php or netremap.php
LMS modules where query parameters contain script tags or event-handler style payloads,
indicating attempted exploitation of the reflected XSS flaw (CVE-2026-40457) typically
delivered via drive-by/crafted link.
tags:
- attack.initial-access
- attack.t1189
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- dbrecover.php
- netremap.php
selection_method:
cs-method: GET
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
condition: selection_endpoint and selection_method and selection_payload
falsepositives:
- Security scanners intentionally probing for reflected XSS as part of authorized
assessments
- Legitimate URLs containing encoded characters that coincidentally match payload
substrings
level: medium
id: b31c5f49-89d0-50b3-a9db-347eaf45d52d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-40455
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free