| शीर्षक | cemtan sar2html 4.0.0 SQL Injection |
|---|
| विवरण | sar2html 4.0.0 is vulnerable to second-order (stored) SQL injection
via directory names inside uploaded tar archives.
In updateDb(), the hostname (s2host) is extracted directly from
directory names inside the tar archive and inserted into the
database without sanitization:
sqlCommand = 'INSERT INTO "hosts" (name, os) VALUES("{}", "{}")'
.format(s2host, s2os.lower())
This stored value is later used unsanitized in subsequent queries
in updateDb() and deleteFromDb():
sqlCommand = 'DELETE FROM "{}" WHERE name = "{}"'
.format(s2table, s2host)
sqlCommand = 'SELECT * from "hosts" where name = "{}"'
.format(s2host)
An attacker crafts a tar archive with a directory named as a SQL
payload. On upload the payload is stored in the database. On
subsequent operations (delete, select) the stored payload executes
as SQL. No authentication is required to reach the upload endpoint.
This is distinct from direct parameter injection — the payload
travels through the filesystem into the database before execution.
Affected component: sar2html.py, functions updateDb() and deleteFromDb()
CWE: CWE-89 (SQL Injection — Second Order / Stored)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|---|
| स्रोत | ⚠️ https://github.com/cemtan/sar2html/issues/22 |
|---|
| उपयोगकर्ता | spoo1k (UID 101695) |
|---|
| सबमिशन | 28/09/2026 11:09 AM (17 दिन पहले) |
|---|
| संयम | 14/10/2026 03:15 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 419833 [cemtan sar2html 4.0.0 Archive Processing sar2html.py updateDb s2host SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|