CVE-2022-35914

The vulnerable code is the bundled htmLawed test harness, specifically htmLawedTest.php shipped inside the htmlawed module of GLPI through 10.0.2. That test file passes request parameters into PHP in a way that lets an unauthenticated attacker inject and execute arbitrary PHP code simply by sending a crafted HTTP request to the exposed script. There is no authentication step and no user interaction, so reaching the endpoint is equivalent to running code as the web server user.

GLPI is a widely deployed open-source IT asset and service-management platform, so vulnerable instances tend to hold inventory data, ticketing, and often credentials for the environments they manage. The endpoint is a leftover test file that should never have been reachable in production, which is exactly the kind of artifact defenders forget is present. Public exploitation followed quickly and it has been folded into commodity scanning and cryptomining campaigns. Upgrade GLPI past 10.0.2, and if the instance was internet-facing, delete or block access to the htmLawed test script and check for web shells and unexpected PHP processes rather than assuming a patch closes the exposure retroactively.