Sar2html - RCE (CVE-2025-34030)
Description
An OS command injection vulnerability exists in Sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
psychologyCrowdSec Analysis
CVE-2025-34030 is a critical OS command injection vulnerability in Sar2html versions 3.2.2 and earlier, allowing remote, unauthenticated attackers to execute arbitrary system commands via the plot parameter in index.php. By crafting malicious GET requests, attackers can gain full control over the underlying server, potentially leading to data theft, system compromise, or further lateral movement within the network. This vulnerability has been actively exploited in the wild, making immediate remediation essential for affected systems.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.
Data from the CrowdSec community indicates that exploitation of CVE-2025-34030 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34030 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers exploit the plot parameter in requests to /index.php by injecting shell metacharacters (such as ;) to execute arbitrary OS commands, enabling remote code execution on vulnerable Sar2html instances.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-06-20 |
| Rule Released | 2026-06-03 |
| CrowdSec First Seen | 2026-06-06 |