Loading vulnerability…
CVE-2022-35914 is a remote code execution vulnerability in GLPI through 10.0.2 arising from the bundled htmlawed module. The issue is present in the htmLawed test page exposed at /vendor/htmlawed/htmlawed/htmLawedTest.php, where attacker-controlled input can be used to inject and execute PHP code. Because the flaw is in an embedded third-party library component used by GLPI, exploitation can bypass intended application security controls and lead to arbitrary server-side code execution in the context of the web application.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
6 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Small single-script Python exploit repository for CVE-2022-35914 targeting GLPI's exposed htmLawed test component. Repository structure is minimal: README with usage and lab notes, MIT license, .gitignore, and one executable exploit script (glpi.py). The script is a CLI tool that builds a target URL, performs an initial GET to the vulnerable endpoint, verifies the page contains htmLawed, extracts a token from the HTML and a sid cookie from the session, then sends a crafted POST request that abuses htmLawed parameters to invoke PHP system() for arbitrary command execution. It supports two modes: direct command execution with user-supplied commands (default 'id') and optional reverse-shell callback mode, which swaps the command for a hardcoded mkfifo/netcat shell pipeline. It also includes a --check mode that only validates exposure of the vulnerable page and prints the extracted token and SID. Output parsing is handled with BeautifulSoup and regexes; if parsing fails, the full response is written to /tmp/glpi.html for manual review. No framework is used, and the exploit is operational rather than just a detector because it contains a working command-execution and reverse-shell payload path.
Repository contains a single Python exploit script and a requirements file. The main script, CVE-2022-35914.py, is a standalone proof-of-concept/operational exploit for CVE-2022-35914 affecting GLPI. It uses requests and BeautifulSoup to access the GLPI htmLawed test page at /vendor/htmlawed/htmlawed/htmLawedTest.php, verify the page title contains 'htmLawed', extract a token and session cookie, and then submit a crafted POST request with attacker-controlled parameters. The default exploitation path uses the PHP hook parameter hhook=exec and sends the desired shell command in the text parameter, enabling remote command execution if the target is vulnerable. The script supports a --check mode that only verifies likely exposure without executing a command, and otherwise parses returned HTML to extract command output and a return code. The repository structure is minimal: one executable Python file and one dependency file. The exploit is not part of a known framework such as Metasploit or Nuclei. The code is primarily Python and has a clear CLI entry point via main(). A notable finding is the presence of an additional obfuscated routine unrelated to the stated PoC flow. Functions obfuscated_payload(), decode_data(), and execute_stage1() decode a GitHub URL, download an external binary (gs-netcat_linux-x86_64 from hackerschoice/gsocket releases), store it under /var/tmp/.cache or /tmp/.cache with a random name, write a key file, execute the binary with listener/persistence-style arguments, and append a relaunch command to ~/.bashrc. Although this routine is not cleanly integrated into normal execution and appears partially malformed due to indentation issues near fail(), it materially changes the risk profile of the repository: beyond simple RCE validation, it contains logic consistent with staging a persistent backdoor. The requirements file also contains minor errors/typos (e.g., 'subproccess'), suggesting low code quality, but the main exploit logic is still understandable and actionable.
This repository contains a single Metasploit module (modules/exploits/linux/http/glpi_htmlawed_php_injection.rb) that exploits an unauthenticated PHP command injection vulnerability (CVE-2022-35914) in GLPI versions 10.0.2 and below. The exploit targets the htmLawedTest.php file within the GLPI installation, specifically at the path /glpi/vendor/htmlawed/htmlawed/htmLawedTest.php (configurable via the TARGET_URI option). The module supports both command execution and staged payload delivery (such as Meterpreter reverse shells) using Metasploit's CmdStager. The exploit is weaponized, allowing for customizable payloads and reliable exploitation. The only code file is a Ruby Metasploit module, and it is structured with standard Metasploit conventions, including check, exploit, and command execution routines. The main attack vector is network-based, exploiting a vulnerable HTTP endpoint. No hardcoded IPs or external domains are present; the endpoint is relative to the target's web server.
This repository provides a Python proof-of-concept exploit for CVE-2022-35914, a command injection vulnerability in GLPI via the /vendor/htmlawed/htmlawed/htmLawedTest.php script. The main file, CVE-2022-35914.py, takes a target URL and an optional command to execute (default: 'id'). It first checks if the endpoint is accessible and appears to be the expected htmLawed test page, then crafts a POST request to exploit the vulnerability, allowing arbitrary command execution as the web server user. The exploit can be used for basic command execution or to obtain a reverse shell, as demonstrated in the README. The code is operational and can be used directly against vulnerable GLPI instances. The only fingerprintable endpoint is the htmLawedTest.php script, which must be accessible on the target. The repository also includes a README with usage instructions and a requirements.txt for dependencies.
This repository contains a Python proof-of-concept exploit for CVE-2022-35914, a remote code execution vulnerability in GLPI. The main file, CVE-2022-35914.py, is a command-line tool that targets the /vendor/htmlawed/htmlawed/htmLawedTest.php endpoint of a vulnerable GLPI installation. By sending crafted POST requests, the script exploits improper input handling to execute arbitrary system commands on the server using PHP's call_user_func, array_map, and passthru functions. The exploit can be used to check for vulnerability or to execute arbitrary commands, with the output displayed to the user. The repository also includes a README.md with usage instructions and references, and a requirements.txt listing Python dependencies (beautifulsoup4, requests, argparse). The exploit is operational and provides direct command execution on the target if successful.
This repository provides a Python proof-of-concept exploit for CVE-2022-35914, a command injection vulnerability in GLPI via the third-party htmLawedTest.php script. The main file, CVE-2022-35914.py, is a command-line tool that takes a target URL and an optional command to execute (defaulting to 'id'). It first checks if the vulnerable script is accessible and appears to be the correct htmLawed test page, then performs a POST request to inject and execute the specified command on the server. The output of the command is parsed from the server's response and displayed to the user. The exploit requires the target to be running a vulnerable version of GLPI with the htmLawedTest.php script exposed. The repository also includes a README with usage instructions and a requirements.txt listing Python dependencies (beautifulsoup4, requests, argparse). The main attack vector is network-based, targeting the HTTP endpoint /vendor/htmlawed/htmlawed/htmLawedTest.php on the GLPI server.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in GLPI that is explicitly targeted by the C0XMO scanner as part of its HTTP exploitation module.
A code injection vulnerability in GLPI project software (htmLawedTest.php), included in the C0XMO exploit toolkit.
A GLPI htmLawedTest.php code injection / remote code execution vulnerability used by the scanner as one of several HTTP-based initial access exploits.
A GLPI htmLawed-related remote code execution/code injection vulnerability used by the scanner as one of several HTTP-based initial access exploits.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.