| عنوان | cemtan sar2html 4.0.0 SQL Injection |
|---|
| الوصف | sar2html 4.0.0 is vulnerable to second-order (stored) SQL injection
via directory names inside uploaded tar archives.
In updateDb(), the hostname (s2host) is extracted directly from
directory names inside the tar archive and inserted into the
database without sanitization:
sqlCommand = 'INSERT INTO "hosts" (name, os) VALUES("{}", "{}")'
.format(s2host, s2os.lower())
This stored value is later used unsanitized in subsequent queries
in updateDb() and deleteFromDb():
sqlCommand = 'DELETE FROM "{}" WHERE name = "{}"'
.format(s2table, s2host)
sqlCommand = 'SELECT * from "hosts" where name = "{}"'
.format(s2host)
An attacker crafts a tar archive with a directory named as a SQL
payload. On upload the payload is stored in the database. On
subsequent operations (delete, select) the stored payload executes
as SQL. No authentication is required to reach the upload endpoint.
This is distinct from direct parameter injection — the payload
travels through the filesystem into the database before execution.
Affected component: sar2html.py, functions updateDb() and deleteFromDb()
CWE: CWE-89 (SQL Injection — Second Order / Stored)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|---|
| المصدر | ⚠️ https://github.com/cemtan/sar2html/issues/22 |
|---|
| المستخدم | spoo1k (UID 101695) |
|---|
| ارسال | 28/09/2026 11:09 AM (17 أيام منذ) |
|---|
| الاعتدال | 14/10/2026 03:15 PM (16 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 419833 [cemtan sar2html 4.0.0 Archive Processing sar2html.py updateDb s2host حقن SQL] |
|---|
| النقاط | 20 |
|---|