← back
CVE-2022-35914

CVE-2022-35914

CVSS 9.8 CRITICALEPSS 99.5%● KEVCWE-74
In short

A test file left in the htmlawed module of GLPI allows attackers to inject and execute arbitrary PHP code on the server. This is a critical vulnerability that gives attackers complete control over the system.

Technical detail

The htmLawedTest.php file in the htmlawed vendor module is publicly accessible and accepts untrusted input that is evaluated as PHP code (CWE-74: Improper Neutralization of Special Elements in Output). Remote attackers can achieve unauthenticated remote code execution on GLPI versions up to 10.0.2, resulting in full system compromise.

Summary generated and translated by AI from the official description.
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 10
githubgithub.com/cosad3s/CVE-2022-35914-poc★ 51githubgithub.com/senderend/CVE-2022-35914★ 4githubgithub.com/0xGabe/CVE-2022-35914★ 2githubgithub.com/noxlumens/CVE-2022-35914_poc★ 2githubgithub.com/Lzer0Kx01/CVE-2022-35914★ 2githubgithub.com/6E6L6F/CVE-2022-35914★ 1githubgithub.com/Johnermac/CVE-2022-35914★ 0githubgithub.com/btar1gan/exploit_CVE-2022-35914★ 0exploitdbwww.exploit-db.com/exploits/52023unverifiedcve_referencepacketstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.htmlhttps://github.com/glpi-project/glpi/releaseshttps://github.com/Orange-Cyberdefense/CVE-repository/https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.shhttps://glpi-project.org/fr/glpi-10-0-3-disponible/https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed