Отправить #1003778: cemtan sar2html 4.0.0 SQL Injection

sar2html 4.0.0 is vulnerable to second-order (stored) SQL injection
via directory names inside uploaded tar archives.

In updateDb(), the hostname (s2host) is extracted directly from
directory names inside the tar archive and inserted into the
database without sanitization:

sqlCommand = 'INSERT INTO "hosts" (name, os) VALUES("{}", "{}")'
.format(s2host, s2os.lower())

This stored value is later used unsanitized in subsequent queries
in updateDb() and deleteFromDb():

sqlCommand = 'DELETE FROM "{}" WHERE name = "{}"'
.format(s2table, s2host)

sqlCommand = 'SELECT * from "hosts" where name = "{}"'
.format(s2host)

An attacker crafts a tar archive with a directory named as a SQL
payload. On upload the payload is stored in the database. On
subsequent operations (delete, select) the stored payload executes
as SQL. No authentication is required to reach the upload endpoint.

This is distinct from direct parameter injection — the payload
travels through the filesystem into the database before execution.

Affected component: sar2html.py, functions updateDb() and deleteFromDb()
CWE: CWE-89 (SQL Injection — Second Order / Stored)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• Источник: ⚠️ https://github.com/cemtan/sar2html/issues/22
• Пользователь: spoo1k (UID 101695)
• Представление: 28.09.2026 11:09 (17 дни назад)
• Модерация: 14.10.2026 15:15 (16 days later)
• Статус: принято
• Запись VulDB: 419833 [cemtan sar2html 4.0.0 Archive Processing sar2html.py updateDb s2host SQL-инъекция]
• Баллы: 20