CVE-2025-34030 PoC — sar2html 安全漏洞

Description

PoC for CVE-2025-34030 sar2html 'plot' parameter RCE

介绍

# CVE-2025-34030 - sar2html 'plot' parameter RCE

CVSS: <span style="color:rgb(192, 0, 0)">10.0 Critical</span><br>
Vulnerability: OS Command Injection<br>
Programming Language: PHP<br>
Exploit Code: Python <br>

References: 
- https://nvd.nist.gov/vuln/detail/CVE-2025-34030
- https://www.vulncheck.com/advisories/sar2html-command-injection

## Description
sar2html version <= 3.2.1 contains an unauthenticated OS Command Injection vulnerability via the plot parameter in index.php (`index.php?plot=; <command>`) the output of the vulnerability is displayed in the application's interface after execution, "select # host" contains command output.
<br>

## Proof of Concept
![Demo Video](img/CVE-2025-34030.gif)

文件快照

备注