EUVD-2026-101615
GHSA-wqc8-9cmp-9x33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed sar2html 4.0.0 instance
-
ExploitSend request with malicious 'sort' parameter
-
ExecutionTrigger SQL injection in index function
-
ImpactExtract or modify backend database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires a reachable sar2html 4.0.0 instance where the index function in sar2html.py processes the user-supplied 'sort' argument; the attacker injects SQL through that specific parameter. Per the provided vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - remote unauthenticated exploitation is possible against a standard sar2html 4.0.0 deployment. The primary limiting factors are the product's very narrow deployment base and the low technical impact (partial confidentiality/integrity/availability only), not any access barrier. |
| Impact | This is a low-to-moderate real-world priority despite being remotely exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which normally elevates concern; however, the impact metrics are uniformly LOW (VC:L/VI:L/VA:L) and the base score is only 5.5 (Medium), reflecting limited damage from this specific SQL injection. The E:P flag in the vector and the description both confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - PoC availability must not be conflated with in-the-wild use. The dominant risk-limiting factor is deployment scale: sar2html is an obscure open-source utility, not enterprise infrastructure, so the attractive 'unauthenticated network' profile is offset by a tiny target population. No SSVC decision data was supplied. The vendor was notified via an issue report but has not responded, meaning no official patch is confirmed available - an unpatched-but-low-footprint situation. Net: treat as a routine-priority fix for the small number of organizations actually running sar2html 4.0.0, not an emergency for the general population. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker locates an internet-facing or internal sar2html 4.0.0 instance and sends a crafted request manipulating the 'sort' parameter handled by the index function in sar2html.py, injecting SQL to read or tamper with backend data. Because public exploit code exists, this requires little skill to reproduce. Given AV:N/AC:L/PR:N/UI:N, the request can be fired directly against a default deployment with no authentication or victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
SQL injection in cemtan sar2html 4.0.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'sort' argument handled by the index function in sar2html.py, enabling partial read and modification of the application's database contents. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no credentials, user interaction, or special configuration are required, so any standard sar2html 4.0.0 instance exposed to a network is reachable. Publicly available exploit code exists and the maintainer has not responded to the upstream issue report; there is no CISA KEV listing, so active exploitation has not been confirmed, and the overall risk is judged low-to-moderate because of the product's narrow deployment base and the limited (partial) confidentiality and integrity impact.
RemediationAI
No vendor-released patch identified at time of analysis, and the upstream project was informed early via https://github.com/cemtan/sar2html/issues/20 but has not responded, so remediation must be compensating rather than version-based. The most effective control is to stop exposing sar2html to untrusted networks: bind it to localhost or place it behind an authenticating reverse proxy or VPN, which removes the unauthenticated remote attack surface entirely at the cost of losing convenient browser access for end users. Where network exposure is unavoidable, add a front-end filter or WAF rule that rejects requests whose 'sort' value contains SQL metacharacters (quotes, comment sequences, UNION/OR keywords) before they reach sar2html.py, and, if the code can be forked locally, replace the string-concatenated query in the index function with a parameterized statement or a strict allow-list of sortable column names; the trade-off is that allow-listing may break legitimate custom sort options, and signature-based filtering can be bypassed by encoding tricks. Until an upstream fix ships, treat any sar2html instance as a higher-risk host and monitor its logs for anomalous SQL syntax in request parameters.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
sar2html is a small Python utility that parses sysstat 'sar' performance output files and renders them as browsable HTML reports. The vulnerable code path is the index function in sar2html.py, which receives a user-controlled 'sort' parameter from the HTTP request and concatenates it into a SQL statement without neutralization, the classic CWE-74 improper-neutralization-of-special-elements root cause that manifests here specifically as SQL injection (CWE-89 semantics under a CWE-74 classification). Because the injection point sits in the request handling of the index route and the assessed vector carries PR:N/UI:N with AC:L/AT:N, a plain HTTP request to a reachable instance is sufficient to reach the sink; no session, token, or privileged role is needed. The scope is unchanged (S:U) and impact is confined to the application's own data store, matching the assessed CVSS:3.1 vector of C:L/I:L/A:N.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SQL injection via the 'sort' parameter (AV:N/AC:L/PR:N/UI:N); partial read/modify of backend data yields C:L/I:L, with no meaningful availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB