The vulnerability is located in the updateDb function of sar2html.py. By manipulating the s2host argument, an attacker can inject arbitrary SQL code into the database. Because the injection occurs within a remote function that accepts external input, a threat actor can potentially read, modify, delete, or add data in the database, compromising confidentiality and integrity. The lack of input validation or parameterization allowed the attacker to subvert the intended logic of the application.

Affected systems are installations of cemtan sar2html version 4.0.0. The issue pertains to the Archive Processing component of that version; no other versions or vendors are listed as affected.

The CVSS score of 6.9 indicates a moderate to high risk. EPSS is currently unavailable, so the likelihood of exploitation cannot be quantified precisely, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely, likely by sending a crafted HTTP request to the updateDb endpoint that contains a malicious s2host value. Without a patch or mitigation, an attacker could exploit this flaw to compromise the database associated with the sar2html instance.