PT-2025-26462 · Sar2Html · Sar2Html

Furkan Kayapinar

·

Published

2019-08-01

·

Updated

2025-11-19

·

CVE-2025-34030

CVSS v4.0

10

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions sar2html versions 3.2.2 and prior
Description An OS command injection vulnerability exists due to insufficient input validation when processing the plot parameter in the index.php file. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter in a crafted GET request (e.g., ?plot=;id). The output of the command is displayed in the application's interface after interacting with the host selection UI, leading to arbitrary command execution on the underlying system.
Recommendations sar2html versions prior to 3.2.2: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

RCE

Weakness Enumeration

CWE-78CWE-20

Related Identifiers

BDU:2025-07735
CVE-2025-34030

Affected Products

Sar2Html