CVE-2024-52792

LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via `mainmanage.php` and `confmain.php`. This allows setting arbitrary config values and thus effectively bypassing `mitigation` of CVE-2024-23333/GHSA-fm9w-7m7v-wxqv. Configuration values for the main config or server profiles are set via `mainmanage.php` and `confmain.php`. The values are written to `config.cfg` or `serverprofile.conf` in the format of `settingsName: settingsValue` line-by-line. An attacker can smuggle arbitrary config values in a config file, by inserting a newline into certain config fields, followed by the value. This vulnerability has been addressed in version 9.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-610

• https://github.com/LDAPAccountManager/lam/blob/fd665fef3b222bf8205154b14f676815d2d6ae20/lam/templates/config/mainmanage.php#L263
• https://github.com/LDAPAccountManager/lam/releases/tag/9.0
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-6cp9-j5r7-xhcc
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-fm9w-7m7v-wxqv

Published

Dec 17, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52786An authentication bypass vulnerability in anji-plus AJ-Repor…9.8
• CVE-2024-52787An issue in the upload_documents method of libre-chat v0.0.6…9.1
• CVE-2024-52788Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcode…8
• CVE-2024-52789Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardc…8
• CVE-2024-5279A vulnerability was found in Qiwen Netdisk up to 1.4.0. It h…5.3
• CVE-2024-52791Matrix Media Repo (MMR) is a highly configurable multi-homes…7.5
• CVE-2024-52793The Deno Standard Library provides APIs for Deno and the Web…5.1
• CVE-2024-52794Discourse is an open source platform for community discussio…6.1
• CVE-2024-52796Password Pusher, an open source application to communicate s…5.3
• CVE-2024-52797Opencast is free and open source software for automated vide…7.5
• CVE-2024-52798path-to-regexp turns path strings into a regular expressions…7.7
• CVE-2024-52799Argo Workflows Chart is used to set up argo and its needed d…8.2