A flaw in the index function of sar2html.py in cemtan sar2html 4.0.0 lets an attacker manipulate the 'sort' parameter to inject arbitrary SQL statements, which are then executed against the underlying database. The injected SQL can read, alter, or delete data, jeopardizing the confidentiality and integrity of data handled by the tool. Because the vulnerability is triggered by a crafted web request, an attacker can exploit it remotely against any exposed instance.

The vulnerable product is cemtan sar2html version 4.0.0, used to convert application SAR logs into HTML reports. Any deployment that exposes the index endpoint to users without strict access controls is susceptible to exploitation.

The CVSS score of 6.9 marks it as moderately severe, and the EPSS score is unavailable, leaving the likelihood of exploitation uncertain. A publicly available exploit script is circulating, and the issue is not listed in CISA's KEV catalog. The remote attack vector means attackers do not need privileged access to the host; they only need network reach to the web service, making the risk significant for exposed installations.