Skip to content

Instantly share code, notes, and snippets.

@claudijd

claudijd/gist:2641442

Created May 9, 2012 02:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save claudijd/2641442 to your computer and use it in GitHub Desktop.
Save claudijd/2641442 to your computer and use it in GitHub Desktop.
Download ZIP
PHP CGI Emerging Threat Snort Rule
Raw
gistfile1.txt
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP-CGI query string parameter vulnerability"; flow:to_server,established; content:"?"; http_uri; content:"-"; http_uri; distance:0; content:!"="; http_raw_uri; pcre:"/(\.php|\/)\?[\s\+]*\-[A-Za-z]/Ui"; reference:cve,2012-1823; reference:url,eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/; reference:url,varanoid.com/research-alerts/us-cert/vu520827-php-cgi-query-string-parameter-vulnerability/; classtype:web-application-attack; sid:2014704; rev:4;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment