This vulnerability in cemtan sar2html 4.0.0 allows remote attackers to perform SQL injection via manipulation of the Search argument in the sar2html.py file's Search component. The flaw permits injection of malicious SQL commands, potentially compromising the underlying database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, and no privileges or user interaction required. The vendor has not issued a fix or advisory, and the exploit is publicly known.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires no privileges, increasing the risk. However, the overall impact is rated medium due to limited complexity and partial impact metrics.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider implementing application-level input validation or filtering to mitigate SQL injection risks. Monitor for updates from the vendor or community for any forthcoming patches. Avoid exposing the vulnerable Search functionality to untrusted networks if possible.