An SQL Injection vulnerability (CWE‑89) exists in the LAN Management System in the "tarifflist.php" module. The code concatenates user‑supplied array values from the POST "tg[]" parameter directly into an SQL query using "implode()", without proper sanitization. This flaw allows an attacker who is authenticated to the system to inject arbitrary SQL statements and retrieve sensitive database contents through error‑based injection techniques.

The vulnerability affects the LAN Management System (LMS) in all versions released before commit 4cb30a7. The affected package does not list specific version numbers beyond the pre‑commit state, so any deployment of LMS that has not applied the patch contained in that commit is susceptible.

The CVSS score is 8.6, indicating a high‑severity flaw that compromises confidentiality. Although the EPSS score is not available, the exploit requires authenticated access, so an insider or compromised user account represents the primary risk. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS rating and the ability to exfiltrate data make it a priority for immediate remediation.