POC详情： 6ab309a16653625de8aeb47cb749888903debf83

来源
https://github.com/0romos/CVE-2022-35914
关联漏洞
标题： GLPI 注入漏洞 (CVE-2022-35914)
描述：GLPI是个人开发者的一款开源IT和资产管理软件。该软件提供功能全面的IT资源管理接口，你可以用它来建立数据库全面管理IT的电脑，显示器，服务器，打印机，网络设备，电话，甚至硒鼓和墨盒等。 GLPI 10.0.2及之前版本存在安全漏洞，该漏洞源于htmlawed 模块中的 /vendor/htmlawed/htmlawed/htmLawedTest.php 允许 PHP 代码注入。
描述
𓃌 - htmlLawed 1.2.5 Remote code Execution
介绍
# Exploit Script Utility

![GitHub](https://img.shields.io/github/license/0romos/CVE-2022-35914)
![GitHub last commit](https://img.shields.io/github/last-commit/0romos/CVE-2022-35914)

## Overview

This repository contains a Python script designed to exploit CVE-2022-35914, a vulnerability in htmlLawed 1.2.5 that allows for Remote Code Execution (RCE). The script sends HTTP POST requests to a specified URL and executes arbitrary commands on the target system.

## CVE-2022-35914

- **Published**: 2022-09-15
- **CVE ID**: CVE-2022-35914
- **Impact**: Remote Code Execution
- **Affected Versions**: htmlLawed 1.2.5

## Usage

### Prerequisites

- Python 3.x
- Required Python packages (install using `pip install -r requirements.txt`)

### Running the Script

#### Single URL

To execute a command on a single target URL:

```bash
python3 exploit.py -u/--url <url> -c/--cmd <command>
```

## Fixes

To mitigate the vulnerability, it is recommended to update htmlLawed to a version that has addressed this vulnerability. Additionally, users should follow security best practices and regularly update their software to protect against known vulnerabilities.

## License

This project is licensed under the [MIT License](LICENSE).
文件快照

 [4.0K]  /data/pocs/6ab309a16653625de8aeb47cb749888903debf83
├── [1.0K]  LICENSE
├── [1.2K]  README.md
└── [4.0K]  src
    ├── [5.1K]  main.py
    └── [  25]  requirements.txt

1 directory, 4 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。