alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:to_server,established; content:"GET"; nocase; http_method; content:".php?"; nocase; http_uri; content:"cmd="; fast_pattern; nocase; http_uri; pcre:"/cmd=[^\x28].*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/Ui"; reference:cve,2002-0953; reference:url,doc.emergingthreats.net/2010920; classtype:web-application-attack; sid:2010920; rev:5;)

Added 2011-10-12 19:30:54 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:to_server,established; content:"GET"; nocase; http_method; content:".php?"; nocase; http_uri; content:"cmd="; fast_pattern; nocase; http_uri; pcre:"/cmd=[^\x28].*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/Ui"; classtype:web-application-attack; reference:cve,2002-0953; reference:url,doc.emergingthreats.net/2010920; sid:2010920; rev:5;)

Added 2011-09-14 22:44:03 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:to_server,established; content:"GET"; nocase; http_method; content:".php?"; nocase; http_uri; content:"cmd="; fast_pattern; nocase; http_uri; pcre:"/cmd=[^\x28].*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/Ui"; classtype:web-application-attack; reference:cve,2002-0953; reference:url,doc.emergingthreats.net/2010920; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_PHP_Injection; sid:2010920; rev:5;)

Added 2011-07-21 21:00:34 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:to_server,established; content:"GET"; nocase; http_method; content:".php?"; nocase; http_uri; content:"cmd="; fast_pattern; nocase; http_uri; pcre:"/cmd=.*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/Ui"; classtype:web-application-attack; reference:cve,2002-0953; reference:url,doc.emergingthreats.net/2010920; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_PHP_Injection; sid:2010920; rev:4;)

Added 2011-02-04 17:30:36 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:to_server,established; content:"GET "; nocase; depth:4; uricontent:".php?"; nocase; uricontent:"cmd="; nocase; pcre:"/cmd=.*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/Ui"; reference:cve,2002-0953; classtype:web-application-attack; reference:url,doc.emergingthreats.net/2010920; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_PHP_Injection; sid:2010920; rev:2;)

Added 2010-03-10 15:00:57 UTC