Loading vulnerability…
SQL Injection in LMS tarifflist.php tg[] parameter
CVE-2026-40455 is an authenticated SQL injection vulnerability in LMS (LAN Management System) affecting versions before commit 4cb30a7. The flaw is located in the tarifflist.php module, where the application insufficiently sanitizes the POST tg[] parameter and directly concatenates user-controlled array values into an SQL query via implode(). This unsafe query construction enables error-based SQL injection against the backend database and allows an authenticated attacker to manipulate SQL execution and extract sensitive database information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to perform error-based SQL injection and retrieve sensitive information from the LMS database. Depending on database permissions and application behavior, this can expose application data and other confidential records accessible to the vulnerable query context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, limit access to the affected LMS instance and module to only trusted authenticated users, reduce exposure of tarifflist.php where operationally feasible, and monitor for anomalous requests involving the tg[] POST parameter. As a defensive code-level measure, validate tg[] as a strictly typed allowlisted input set and eliminate direct SQL string concatenation in favor of prepared statements.
Patch, then assume compromise.
Update LMS to a version that includes commit 4cb30a7 or later, which addresses the vulnerable behavior in tarifflist.php. The underlying fix should ensure that the tg[] POST parameter is properly validated and sanitized and that user-controlled values are not concatenated directly into SQL statements. Use parameterized queries or prepared statements and enforce strict type checking for array elements before they are incorporated into database operations.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.