CVE-2025-34030 Information

Jun 21, 2025 cve

Description

An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g. ?plot=;id) in a crafted GET request. The output of the command is displayed in the application’s interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system.

Reference

https://github.com/cemtan/sar2html https://vulncheck.com/advisories/sar2html-command-injection https://www.exploit-db.com/exploits/47204 https://www.fortiguard.com/encyclopedia/ips/48624

CNNVD-202506-2809 (Published: 2025-06-20)

Share on: