# LMS software patches three vulnerabilities Published: 2026-06-18 · Severity: medium · Sectors: telecommunications Canonical: https://vorant.io/reports/104392cd-7f61-552e-8e79-fbfe51e917ac/lms-software-patches-three-vulnerabilities > CERT Polska coordinated disclosure of SQL injection, OS command injection, and XSS flaws in LAN Management System (LMS) software. CERT Polska has published details on three vulnerabilities affecting LMS (LAN Management System), an open-source ISP billing and network management platform. The most severe, CVE-2026-40456, is an OS command injection flaw where an IP address parameter is passed unsanitized to exec(), allowing arbitrary command execution. CVE-2026-40455 is an error-based SQL injection in the tarifflist.php module caused by unsafe concatenation of the POST tg[] parameter via implode(), enabling authenticated attackers to extract database contents. CVE-2026-40457 is a reflected XSS issue in the dbrecover.php and netremap.php modules stemming from unsanitized GET parameters. All three vulnerabilities require authentication or specific conditions (such as a network being defined and a victim clicking a crafted link for the XSS case), which limits mass-exploitation potential but still poses meaningful risk to organizations running LMS for network and subscriber management, typically ISPs and telecom operators. The issues were fixed in specific upstream commits, and the report credits researcher Tymoteusz Dominik for responsible disclosure through CERT Polska's coordinated vulnerability disclosure (CVD) process. No evidence of active exploitation is mentioned in the advisory. ## Mentioned in this report - Vulnerabilities: CVE-2026-40455, CVE-2026-40456, CVE-2026-40457 ## Detection guidance (public sample) ### Web Server Spawning Network Diagnostic Command After LMS Request ATT&CK: T1190 Detects a web server / PHP-FPM process spawning a shell that invokes network diagnostic utilities (ping/traceroute/nslookup), consistent with exploitation of an unsanitized IP parameter passed to exec() as in the LMS CVE-2026-40456 command injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Web Server Spawning Network Diagnostic Command After LMS Request description: Detects Apache/Nginx/PHP-FPM worker processes spawning a shell that runs ping/traceroute/nslookup with an argument, matching the exec() OS command injection pattern where an unsanitized IP parameter is concatenated into a system command by ISP/LMS-style management applications. tags: - attack.execution - attack.initial-access - attack.t1190 - attack.t1059 logsource: category: process_creation product: linux detection: selection_parent: ParentImage|endswith: - /httpd - /apache2 - /nginx - /php-fpm - /php-fpm7 - /php-fpm8 selection_child: Image|endswith: - /sh - /bash - /dash selection_cmd: CommandLine|contains: - 'ping ' - 'traceroute ' - 'nslookup ' - 'fping ' condition: selection_parent and selection_child and selection_cmd falsepositives: - Legitimate network monitoring plugins that shell out to ping/traceroute for connectivity checks - Admin-triggered diagnostics through a web-based management console using the same binaries level: high id: 0d6e693f-633c-5997-98dd-ee29975d340b status: experimental author: Vorant ``` ### SQL Injection Attempt Against LMS tarifflist.php tg Parameter ATT&CK: T1190 Detects HTTP requests to the LMS tarifflist.php endpoint carrying SQL injection payloads in the tg[] POST parameter, matching CVE-2026-40455 error-based SQL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: SQL Injection Attempt Against LMS tarifflist.php tg Parameter description: Detects requests to tarifflist.php where the tg[] parameter (used unsafely via implode() concatenation) contains classic SQL injection markers, indicating exploitation attempts of CVE-2026-40455. tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection_endpoint: cs-uri-stem|contains: tarifflist.php selection_param: cs-uri-query|contains: tg[ selection_payload: cs-uri-query|contains: - UNION SELECT - union select - ''' OR ''' - ' OR 1=1' - --+ - SLEEP( - sleep( condition: selection_endpoint and selection_param and selection_payload falsepositives: - Automated web vulnerability scanners run by the organization's own security team against LMS - Penetration testing activity targeting the tarifflist module level: high id: 06daf450-930a-5100-8684-7e5c59c1c045 status: experimental author: Vorant ``` ### Reflected XSS Attempt Against LMS dbrecover.php or netremap.php ATT&CK: T1189 Detects GET requests to LMS dbrecover.php or netremap.php modules containing script/HTML injection markers, matching CVE-2026-40457 reflected XSS which requires a victim to click a crafted link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Reflected XSS Attempt Against LMS dbrecover.php or netremap.php description: Detects HTTP GET requests to the vulnerable dbrecover.php or netremap.php LMS modules where query parameters contain script tags or event-handler style payloads, indicating attempted exploitation of the reflected XSS flaw (CVE-2026-40457) typically delivered via drive-by/crafted link. tags: - attack.initial-access - attack.t1189 - attack.t1190 logsource: category: webserver detection: selection_endpoint: cs-uri-stem|contains: - dbrecover.php - netremap.php selection_method: cs-method: GET selection_payload: cs-uri-query|contains: -