Description
GLPI-Project GLPI存在命令注入漏洞。该漏洞是由于对发送到站点htmLawedTest.php的用户配置数据验证不当导致的。
GLPI-Project GLPI htmLawedTest.php 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb
https://sploitus.com/exploit?id=MSF:EXPLOIT-LINUX-HTTP-GLPI_HTMLAWED_PHP_INJECTION-
https://stack.chaitin.com/vuldb/detail/71e4d8de-28ec-41e2-a373-e2d773509978
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2022-ALE-010/
https://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
https://vulnerability.circl.lu/vuln/CVE-2022-35914
https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:GLPI-HTMLLAWEDTEST-RCE.html