LDAP Account Manager Parameter Injection Vulnerability

LDAP Account Manager is a web front-end for managing entries (e.g., users, groups, DHCP settings) stored in the LDAP directory. LDAP Account Manager (LAM) versions prior to 8.0 are vulnerable to parameter injection, which stems from the fact that LAM instantiates objects from arbitrary classes and can be exploited by attackers to cause code execution.