CVE-2022-35914

CVE-2022-35914

NVD Published Date: September 19, 2022 at 04:15 PM

NVD Last Modified: October 28, 2022 at 09:14 PM

Download Patch

Vulnerability ID

CVE-2022-35914

Severity

CRITICAL

Severity Score

9.8

Summary

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

References

http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed

https://github.com/glpi-project/glpi/releases

https://glpi-project.org/fr/glpi-10-0-3-disponible/

http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html

Mitigation and Patches

http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed

Exploits

https://www.exploit-db.com/exploits/52023

https://github.com/cosad3s/CVE-2022-35914-poc

https://github.com/cactuschibre/CVE-2022-35914-poc

https://github.com/cosad3s/CVE-2022-35914-poc

https://glpi-project.org/security-update-10-0-3-and-9-5-9/

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb

http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Metasploit Payload

https://github.com/cosad3s/CVE-2022-35914-poc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE ID

CWE-74

Recent Publish

CVE-2024-8087

CVE-2024-8086

CVE-2024-38210

CVE-2024-38208

CVE-2024-38209

CVE-2024-8089

See SecOps Solution
in action

Schedule Demo

Agentless security for your infrastructure and applications - to build faster, more securely and in a fraction of the operational cost of other solutions