EUVD-2025-18774Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Lifecycle Timeline
4DescriptionCVE.org
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
AnalysisAI
CVE-2025-34030 is a critical OS command injection vulnerability in sar2html versions 3.2.2 and earlier that allows unauthenticated remote attackers to execute arbitrary shell commands through unsanitized input in the 'plot' parameter of index.php. The vulnerability has a perfect CVSS score of 10.0 and requires no authentication, user interaction, or special privileges to exploit. Active exploitation was observed by the Shadowserver Foundation as of February 4, 2025, indicating this is not a theoretical threat.
Technical ContextAI
sar2html is a web application that visualizes system activity reports (SAR data) generated by the Linux sysstat package. The vulnerability exists in the index.php file's handling of the 'plot' GET parameter, which is passed unsanitized into a system-level command execution context (likely via PHP functions such as shell_exec(), system(), passthru(), or proc_open()). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection flaw where user input is concatenated into OS command strings without proper escaping or parameterization. The attacker can inject shell metacharacters (semicolons, pipes, backticks, command substitution syntax) to chain arbitrary commands. The vulnerability is reachable via HTTP GET requests with no prior authentication, making it maximally accessible. Affected CPE would be: cpe:2.3:a:sar2html:sar2html:*:*:*:*:*:*:*:* with versions up to and including 3.2.2.
RemediationAI
Immediate actions: (1) If a patched version (likely 3.2.3 or later) is available from the sar2html project, upgrade immediately—this is the definitive fix. (2) If no patch is available, implement network-level mitigations: restrict HTTP access to sar2html to trusted IPs only via firewall rules or web server configuration (e.g., Apache/Nginx allow lists). (3) Disable or remove sar2html if not actively used. (4) As a temporary mitigation pending patching, implement strict input validation on the 'plot' parameter at the web server or WAF level: reject requests containing shell metacharacters (;|&`$()[]{}><\") or use a positive whitelist allowing only alphanumeric characters and safe delimiters. (5) Deploy Web Application Firewall (WAF) rules to detect command injection patterns in query parameters. (6) Monitor application and system logs for suspicious plot parameter values or unexpected command execution. (7) Consider running sar2html in a containerized/sandboxed environment with minimal privileges to limit blast radius. Check the official sar2html GitHub repository or SourceForge project page for official patch releases and vendor advisories.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today