CVE-2025-34030

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-34030
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34030.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-34030
Published
2025-06-20T18:40:04.545Z
Modified
2026-08-12T03:51:16.228461646Z
Severity
  • 10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
sar2html OS Command Injection
Details

An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34030.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ]
}
References

Affected packages

Git / github.com/cemtan/sar2html

Affected ranges

Type
GIT
Repo
https://github.com/cemtan/sar2html
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a0d136538c893224abc06ffea282042d7984caa0
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.2"
        }
    ]
}

Affected versions

3.*
3.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34030.json"