LMS software patches three vulnerabilities
CERT Polska coordinated disclosure of SQL injection, OS command injection, and XSS flaws in LAN Management System (LMS) software.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has published details on three vulnerabilities affecting LMS (LAN Management System), an open-source ISP billing and network management platform. The most severe, CVE-2026-40456, is an OS command injection flaw where an IP address parameter is passed unsanitized to exec(), allowing arbitrary command execution. CVE-2026-40455 is an error-based SQL injection in the tarifflist.php module caused by unsafe concatenation of the POST tg[] parameter via implode(), enabling authenticated attackers to extract database contents. CVE-2026-40457 is a reflected XSS issue in the dbrecover.php and netremap.php modules stemming from unsanitized GET parameters.
All three vulnerabilities require authentication or specific conditions (such as a network being defined and a victim clicking a crafted link for the XSS case), which limits mass-exploitation potential but still poses meaningful risk to organizations running LMS for network and subscriber management, typically ISPs and telecom operators. The issues were fixed in specific upstream commits, and the report credits researcher Tymoteusz Dominik for responsible disclosure through CERT Polska's coordinated vulnerability disclosure (CVD) process. No evidence of active exploitation is mentioned in the advisory.
Mentioned in this report
Detection guidance
Web Server Spawning Network Diagnostic Command After LMS Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server / PHP-FPM process spawning a shell that invokes network diagnostic utilities (ping/traceroute/nslookup), consistent with exploitation of an unsanitized IP parameter passed to exec() as in the LMS CVE-2026-40456 command injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Spawning Network Diagnostic Command After LMS Request
description: Detects Apache/Nginx/PHP-FPM worker processes spawning a shell that runs
ping/traceroute/nslookup with an argument, matching the exec() OS command injection
pattern where an unsanitized IP parameter is concatenated into a system command
by ISP/LMS-style management applications.
tags:
- attack.execution
- attack.initial-access
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'ping '
- 'traceroute '
- 'nslookup '
- 'fping '
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legitimate network monitoring plugins that shell out to ping/traceroute for connectivity
checks
- Admin-triggered diagnostics through a web-based management console using the same
binaries
level: high
id: 0d6e693f-633c-5997-98dd-ee29975d340b
status: experimental
author: Vorant
SQL Injection Attempt Against LMS tarifflist.php tg Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the LMS tarifflist.php endpoint carrying SQL injection payloads in the tg[] POST parameter, matching CVE-2026-40455 error-based SQL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Attempt Against LMS tarifflist.php tg Parameter
description: Detects requests to tarifflist.php where the tg[] parameter (used unsafely
via implode() concatenation) contains classic SQL injection markers, indicating
exploitation attempts of CVE-2026-40455.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: tarifflist.php
selection_param:
cs-uri-query|contains: tg[
selection_payload:
cs-uri-query|contains:
- UNION SELECT
- union select
- ''' OR '''
- ' OR 1=1'
- --+
- SLEEP(
- sleep(
condition: selection_endpoint and selection_param and selection_payload
falsepositives:
- Automated web vulnerability scanners run by the organization's own security team
against LMS
- Penetration testing activity targeting the tarifflist module
level: high
id: 06daf450-930a-5100-8684-7e5c59c1c045
status: experimental
author: Vorant
Reflected XSS Attempt Against LMS dbrecover.php or netremap.php
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects GET requests to LMS dbrecover.php or netremap.php modules containing script/HTML injection markers, matching CVE-2026-40457 reflected XSS which requires a victim to click a crafted link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against LMS dbrecover.php or netremap.php
description: Detects HTTP GET requests to the vulnerable dbrecover.php or netremap.php
LMS modules where query parameters contain script tags or event-handler style payloads,
indicating attempted exploitation of the reflected XSS flaw (CVE-2026-40457) typically
delivered via drive-by/crafted link.
tags:
- attack.initial-access
- attack.t1189
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- dbrecover.php
- netremap.php
selection_method:
cs-method: GET
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
condition: selection_endpoint and selection_method and selection_payload
falsepositives:
- Security scanners intentionally probing for reflected XSS as part of authorized
assessments
- Legitimate URLs containing encoded characters that coincidentally match payload
substrings
level: medium
id: b31c5f49-89d0-50b3-a9db-347eaf45d52d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-40455
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs