CRITICAL

CVE-2022-35914

Glpi-project Glpi 2022-09-19 CVSS v3.1

CVSS

9.8

KEV

Description

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Summary dbcve.org

A PHP code injection vulnerability exists in the htmlawed module bundled with GLPI versions up to 10.0.2. The exposed test file at /vendor/htmlawed/htmlawed/htmLawedTest.php can be abused to inject and execute arbitrary PHP code, and the 9.8 CVSS score indicates remote, unauthenticated exploitation is plausible. Successful exploitation would result in full application/server compromise under the web service account.

Mitigation

Upgrade GLPI to a version newer than 10.0.2 that addresses this issue, or as an interim measure remove/rename the htmLawedTest.php file in the vendor directory and restrict web access to any htmlawed test endpoints.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-74 Injection

EPSS Score

99.88%

Probability of exploitation in next 30 days

100th percentile

References

http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html Exploit, Third Party Advisory, VDB Entry http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed Patch, Third Party Advisory https://github.com/Orange-Cyberdefense/CVE-repository/ Third Party Advisory https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh Exploit https://github.com/glpi-project/glpi/releases Release Notes, Third Party Advisory https://glpi-project.org/fr/glpi-10-0-3-disponible/ Release Notes, Vendor Advisory https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/ Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE