CVE-2025-34030

sar2html version 3.2.2 and prior contains an OS command injection flaw (CWE-78) in which the plot parameter of index.php is passed to a system-level context without sanitizing user-supplied input. A remote, unauthenticated attacker can exploit it by sending a crafted GET request that appends shell commands to the plot parameter (e.g., ?plot=;id), with the command output displayed in the application's interface after interacting with the host selection UI. Successful exploitation yields arbitrary command execution on the underlying system with the privileges of the web application. Any deployment running sar2html 3.2.2 or earlier — typically a web UI installed on individual Linux/Unix servers to graph sar performance data — is affected, especially instances reachable from the internet. Exploitation has already been observed in the wild: the Shadowserver Foundation recorded exploitation evidence on 2025-02-04 UTC, and the flaw carries a high exploitation probability (EPSS 60.3% over 30 days, 99th percentile).

What to do: Upgrade sar2html to a release newer than 3.2.2 when available, and until then restrict access to the web UI to trusted networks and block or sanitize shell metacharacters in the plot parameter. Because in-the-wild exploitation was observed on 2025-02-04, review web server logs for GET requests to index.php containing commands injected via the plot parameter and investigate any suspicious hits.