提出 #1003778: cemtan sar2html 4.0.0 SQL Injection

sar2html 4.0.0 is vulnerable to second-order (stored) SQL injection
via directory names inside uploaded tar archives.

In updateDb(), the hostname (s2host) is extracted directly from
directory names inside the tar archive and inserted into the
database without sanitization:

sqlCommand = 'INSERT INTO "hosts" (name, os) VALUES("{}", "{}")'
.format(s2host, s2os.lower())

This stored value is later used unsanitized in subsequent queries
in updateDb() and deleteFromDb():

sqlCommand = 'DELETE FROM "{}" WHERE name = "{}"'
.format(s2table, s2host)

sqlCommand = 'SELECT * from "hosts" where name = "{}"'
.format(s2host)

An attacker crafts a tar archive with a directory named as a SQL
payload. On upload the payload is stored in the database. On
subsequent operations (delete, select) the stored payload executes
as SQL. No authentication is required to reach the upload endpoint.

This is distinct from direct parameter injection — the payload
travels through the filesystem into the database before execution.

Affected component: sar2html.py, functions updateDb() and deleteFromDb()
CWE: CWE-89 (SQL Injection — Second Order / Stored)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• ソース: ⚠️ https://github.com/cemtan/sar2html/issues/22
• ユーザー: spoo1k (UID 101695)
• 送信: 2026年09月28日 11:09 (17 日 ago)
• モデレーション: 2026年10月14日 15:15 (16 days later)
• ステータス: 承諾済み
• VulDBエントリ: 419833 [cemtan sar2html 4.0.0 Archive Processing sar2html.py updateDb s2host SQLインジェクション]
• ポイント: 20