Submit #1003778: cemtan sar2html 4.0.0 SQL Injection

sar2html 4.0.0 is vulnerable to second-order (stored) SQL injection
via directory names inside uploaded tar archives.

In updateDb(), the hostname (s2host) is extracted directly from
directory names inside the tar archive and inserted into the
database without sanitization:

sqlCommand = 'INSERT INTO "hosts" (name, os) VALUES("{}", "{}")'
.format(s2host, s2os.lower())

This stored value is later used unsanitized in subsequent queries
in updateDb() and deleteFromDb():

sqlCommand = 'DELETE FROM "{}" WHERE name = "{}"'
.format(s2table, s2host)

sqlCommand = 'SELECT * from "hosts" where name = "{}"'
.format(s2host)

An attacker crafts a tar archive with a directory named as a SQL
payload. On upload the payload is stored in the database. On
subsequent operations (delete, select) the stored payload executes
as SQL. No authentication is required to reach the upload endpoint.

This is distinct from direct parameter injection — the payload
travels through the filesystem into the database before execution.

Affected component: sar2html.py, functions updateDb() and deleteFromDb()
CWE: CWE-89 (SQL Injection — Second Order / Stored)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• Source: ⚠️ https://github.com/cemtan/sar2html/issues/22
• User: spoo1k (UID 101695)
• Submission: 09/28/2026 11:09 (17 days ago)
• Moderation: 10/14/2026 15:15 (16 days later)
• Status: Accepted
• VulDB entry: 419833 [cemtan sar2html 4.0.0 Archive Processing sar2html.py updateDb s2host sql injection]
• Points: 20