CVE-2022-35914 PoC — GLPI 注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35914.yaml

Associated Vulnerability

Title:GLPI 注入漏洞 (CVE-2022-35914)
Description:GLPI是个人开发者的一款开源IT和资产管理软件。该软件提供功能全面的IT资源管理接口，你可以用它来建立数据库全面管理IT的电脑，显示器，服务器，打印机，网络设备，电话，甚至硒鼓和墨盒等。 GLPI 10.0.2及之前版本存在安全漏洞，该漏洞源于htmlawed 模块中的 /vendor/htmlawed/htmlawed/htmLawedTest.php 允许 PHP 代码注入。

Description

GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module.

File Snapshot


 id: CVE-2022-35914

info:
  name: GLPI <=10.0.2 - Remote Command Execution
  author: For3stCo1d,alle

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!