{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/cemtan/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cemtan:sar2html:4.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-110668"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sar2html (4.0.0)"],"_cs_severities":["high"],"_cs_tags":["sqli","vulnerability","webserver"],"_cs_type":"advisory","_cs_vendors":["cemtan"],"content_html":"\u003cp\u003eThe open-source monitoring tool sar2html version 4.0.0 contains a SQL injection vulnerability within the index function of the sar2html.py script. The application fails to properly sanitize the 'sort' argument provided by users, which allows an unauthenticated remote attacker to inject malicious SQL commands directly into database queries. This vulnerability is significant because a public proof-of-concept exploit is available, and the maintainers have not issued a patch to address the security flaw. Organizations currently running sar2html 4.0.0 should restrict network access to the application or implement web application firewall (WAF) rules to filter malicious payloads targeting the 'sort' parameter until a vendor-supplied update is released.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify instances of sar2html 4.0.0 exposed to the internet.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET or POST request targeting the index function of sar2html.py.\u003c/li\u003e\n\u003cli\u003eAttacker injects malicious SQL syntax into the 'sort' parameter (e.g., payloads using 'UNION SELECT' or time-based blind SQLi).\u003c/li\u003e\n\u003cli\u003eThe web server passes the unsanitized 'sort' parameter directly to the backend database query.\u003c/li\u003e\n\u003cli\u003eThe database executes the injected SQL command, allowing the attacker to retrieve or modify data.\u003c/li\u003e\n\u003cli\u003eThe application returns the results of the malicious query in the HTTP response body.\u003c/li\u003e\n\u003cli\u003eAttacker extracts sensitive data from the database, such as administrator credentials or system configuration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unauthenticated attacker to gain unauthorized access to the underlying database. Depending on the database configuration, this can result in the exposure of sensitive application data, credential theft, or further lateral movement within the network. As there is currently no patch, all instances of sar2html 4.0.0 are considered high-risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement WAF rules to block requests containing common SQL injection keywords (such as UNION, SELECT, OR, SLEEP, or --) within the 'sort' parameter of requests directed at sar2html.py.\u003c/li\u003e\n\u003cli\u003eAudit access logs for suspicious HTTP requests containing special characters or SQL syntax in the 'sort' query parameter.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the sar2html application to trusted internal IP ranges only until the vendor provides a remediation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T22:33:30Z","date_published":"2026-10-14T20:33:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sar2html-sqli/","summary":"The sar2html 4.0.0 application is vulnerable to remote SQL injection via the 'sort' parameter in sar2html.py, enabling unauthenticated attackers to execute arbitrary database queries.","title":"SQL Injection in sar2html","url":"https://feed.craftedsignal.io/briefs/2026-10-sar2html-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cemtan","version":"https://jsonfeed.org/version/1.1"}