PT-2022-23020 · Glpi+2 · Glpi+2

Mayfly · CVE-2022-35914 · Published 2016-08-25 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.3

Description The htmlawed module in GLPI contains an issue related to improper input validation and code generation management. This allows a remote attacker to perform PHP code injection via the endpoint "/vendor/htmlawed/htmlawed/htmLawedTest.php".

Recommendations Update to a version later than 10.0.2. As a temporary workaround, restrict access to the file "/vendor/htmlawed/htmlawed/htmLawedTest.php" to minimize the risk of exploitation.

Exploit

Fix

DoS

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

ALT-PU-2016-1892

ALT-PU-2020-3130

ALT-PU-2020-3162

ALT-PU-2020-3557

ALT-PU-2020-3558

ALT-PU-2021-1583

ALT-PU-2021-1660

ALT-PU-2021-1793

ALT-PU-2021-1910

ALT-PU-2021-3030

ALT-PU-2021-3038

ALT-PU-2021-3059

ALT-PU-2022-1463

ALT-PU-2022-1514

ALT-PU-2022-1526

ALT-PU-2022-1914

ALT-PU-2022-2177

ALT-PU-2022-2221

ALT-PU-2022-2291

ALT-PU-2022-2614

ALT-PU-2022-2624

ALT-PU-2022-2665

ALT-PU-2022-3008

ALT-PU-2022-3078

ALT-PU-2022-3274

ALT-PU-2023-1471

ALT-PU-2023-1490

ALT-PU-2023-1537

ALT-PU-2023-1801

ALT-PU-2023-1932

ALT-PU-2023-2081

ALT-PU-2023-4552

ALT-PU-2023-5122

ALT-PU-2023-6186

ALT-PU-2023-7633

ALT-PU-2023-8061

ALT-PU-2023-8087

ALT-PU-2024-2541

ALT-PU-2024-2543

ALT-PU-2024-4487

ALT-PU-2024-4750

ALT-PU-2024-7181

ALT-PU-2024-7305

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2025-03383

CVE-2022-35914

Affected Products

Alt Linux

Glpi

Red Os

References · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35914.json · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository · Exploit
• 🔥 https://github.com/cosad3s/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/cactuschibre/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS · Exploit
• 🔥 https://github.com/Wangyanan131/CVE-2022-31061 · Exploit
• 🔥 https://github.com/Vu0r1-sec/CVE-2022-31061 · Exploit
• 🔥 https://exploit-db.com/exploits/52023 · Exploit
• 🔥 https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914 · Exploit
• 🔥 http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35914 · Security Note
• http://bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed · Patch
• https://osv.dev/vulnerability/CVE-2022-35914 · Vendor Advisory