| tiêu đề | cemtan sar2html 4.0.0 SQL Injection |
|---|
| Mô tả | sar2html 4.0.0 is vulnerable to SQL injection via the sort
parameter in the index route (GET /). The parameter is
concatenated directly into a raw SQL query in the ORDER BY
clause without sanitization or parameterization:
sort = request.args['sort']
conn.execute('SELECT * FROM hosts ORDER by {}'.format(sort))
No authentication is required to reach this endpoint. This is
a distinct vulnerability from CVE-2026-18719, which covers the
search parameter in a WHERE clause via POST /search. This issue
affects a different parameter (sort), a different HTTP method
(GET), a different route (/), and a different SQL clause
(ORDER BY), which has distinct exploitation characteristics
including blind time-based injection.
Affected component: sar2html.py, function index()
Attack vector: Network
Privileges required: None
User interaction: None
CWE: CWE-89 (SQL Injection)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
|---|
| Nguồn | ⚠️ https://github.com/cemtan/sar2html/issues/20 |
|---|
| Người dùng | spoo1k (UID 101695) |
|---|
| Đệ trình | 28/09/2026 10:53 (cách đây 17 ngày) |
|---|
| Kiểm duyệt | 14/10/2026 15:12 (16 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 419828 [cemtan sar2html 4.0.0 sar2html.py index sort Tiêm SQL] |
|---|
| điểm | 20 |
|---|