$ python3 poc_fields_rce.py -h
usage: poc_fields_rce.py [-h] --url URL --cookie-name COOKIE_NAME --cookie-value COOKIE_VALUE --php PHP [--no-cleanup]

GLPI Fields plugin <=1.23.2 dropdown-generation RCE (blind).

options:
  -h, --help            show this help message and exit
  --url URL             Target base URL, e.g. http://your.glpi.instance.local
  --cookie-name COOKIE_NAME
                        GLPI session cookie name (glpi_<hash>)
  --cookie-value COOKIE_VALUE
                        GLPI session cookie value
  --php PHP             Raw PHP to execute on the server (end statements with ';', < ~100 chars)
  --no-cleanup          Keep the container/field (default purges it; leaving it breaks Setup > Dropdowns).