Unauthenticated command execution via controllable hook callback

Command injection in GLPI 9.5.4 through 10.0.2 allows remote attackers to execute arbitrary system commands through the bundled htmLawed test page. htmLawedTest.php copies POST keys beginning with h into the library configuration, letting the hhook value select exec as a callable hook while attacker-controlled text becomes its command argument. The test page is reachable without authentication in default release packages, so successful requests run commands with the web server process's privileges and expose command output in the response.