Tymoteusz Dominik

**Name of the Vulnerable Software and Affected Versions** LMS (LAN Management System) versions prior to commit 4cb30a7 **Description** An SQL Injection issue exists within the "tarifflist.php" module. The application fails to properly sanitize the POST parameter `tg[]`, directly concatenating user-supplied array values into an SQL query via the `implode()` function. This allows authenticated attackers to perform Error-Based SQL injection, a technique that leverages database error messages to retrieve sensitive information, and extract data from the database. **Recommendations** Update to commit 4cb30a7 or a newer version. As a temporary workaround, restrict access to the "tarifflist.php" module or avoid using the `tg[]` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** LMS (LAN Management System) versions prior to commit 9fcb4de **Description** An OS Command Injection issue exists where an IP address parameter is passed to the `exec()` function without proper validation. This allows attackers to execute arbitrary operating system commands on the host. **Recommendations** Update to commit 9fcb4de or a newer version. As a temporary workaround, restrict access to the functionality that utilizes the `exec()` function with IP address parameters.

**Name of the Vulnerable Software and Affected Versions** LMS (LAN Management System) versions prior to commit 9c5651b **Description** A Reflected Cross-Site Scripting (XSS) issue exists in the "dbrecover.php" and "netremap.php" modules. This occurs because unsanitized GET parameters are directly embedded into the HTML output. An attacker can inject arbitrary JavaScript if an authenticated user clicks a specially crafted link, assuming specific conditions, such as a defined network in the system, are met. **Recommendations** Update to commit 9c5651b or a newer version. As a temporary workaround, restrict access to the "dbrecover.php" and "netremap.php" modules to minimize the risk of exploitation.