This vulnerability in cemtan sar2html 4.0.0 involves SQL injection via manipulation of the Search argument in the sar2html.py file. The flaw allows remote attackers to inject SQL commands, potentially compromising the database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no user interaction, and partial impact on confidentiality, integrity, and availability. The vendor was contacted but did not respond, and no patch or mitigation has been published. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to partial confidentiality, integrity, and availability impacts and low attack complexity.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, avoid exposing the vulnerable Search functionality to untrusted users or networks. Consider implementing web application firewalls or input validation as temporary mitigations, but these are not guaranteed to fully prevent exploitation.