alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV authentication_index.php base directory manipulation attempt"; flow:to_server,established; uricontent:"/authentication_index.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; metadata:service http; reference:bugtraq,9368; reference:cve,2004-0030; classtype:web-application-attack; sid:2366; rev:5;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV functions.php base directory manipulation attempt"; flow:to_server,established; uricontent:"/functions.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; metadata:service http; reference:bugtraq,9368; reference:cve,2004-0030; classtype:web-application-attack; sid:2367; rev:5;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV config_gedcom.php base directory manipulation attempt"; flow:to_server,established; uricontent:"/config_gedcom.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; metadata:service http; reference:bugtraq,9368; reference:cve,2004-0030; classtype:web-application-attack; sid:2368; rev:5;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV base directory manipulation"; flow:to_server,established; uricontent:"_conf.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; metadata:service http; reference:bugtraq,9368; classtype:web-application-attack; sid:2926; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Photopost PHP Pro showphoto.php access"; flow:to_server,established; uricontent:"/showphoto.php"; nocase; metadata:service http; reference:bugtraq,9557; classtype:web-application-activity; sid:2372; rev:3;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP /_admin access"; flow:to_server,established; uricontent:"/_admin/"; nocase; metadata:service http; reference:bugtraq,9537; reference:nessus,12032; classtype:web-application-activity; sid:2393; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP WAnewsletter newsletter.php file include attempt"; flow:to_server,established; uricontent:"newsletter.php"; nocase; content:"waroot"; nocase; content:"start.php"; nocase; metadata:service http; reference:bugtraq,6965; classtype:web-application-attack; sid:2398; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP WAnewsletter db_type.php access"; flow:to_server,established; uricontent:"/sql/db_type.php"; nocase; metadata:service http; reference:bugtraq,6964; classtype:web-application-activity; sid:2399; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phptest.php access"; flow:to_server,established; uricontent:"/phptest.php"; nocase; metadata:service http; reference:bugtraq,9737; classtype:web-application-activity; sid:2405; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP IGeneric Free Shopping Cart page.php access"; flow:to_server,established; uricontent:"/page.php"; nocase; metadata:service http; reference:bugtraq,9773; classtype:web-application-activity; sid:2410; rev:3;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP modules.php access"; flow:to_server,established; uricontent:"/modules.php"; nocase; metadata:service http; reference:bugtraq,9879; classtype:web-application-activity; sid:2565; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PHPBB viewforum.php access"; flow:to_server,established; uricontent:"/viewforum.php"; nocase; metadata:service http; reference:bugtraq,9865; reference:bugtraq,9866; reference:nessus,12093; classtype:web-application-activity; sid:2566; rev:5;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Opt-X header.php remote file include attempt"; flow:to_server,established; uricontent:"/header.php"; nocase; content:"systempath="; pcre:"/systempath=(https?|ftps?|php)/i"; metadata:service http; reference:bugtraq,9732; classtype:web-application-attack; sid:2575; rev:3;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP TUTOS path disclosure attempt"; flow:to_server,established; uricontent:"/note_overview.php"; content:"id="; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:bugtraq,10129; reference:url,www.securiteam.com/unixfocus/5FP0J15CKE.html; classtype:web-application-activity; sid:2588; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-PHP PHPNuke Forum viewtopic SQL insertion attempt"; flow:to_server,established; uricontent:"/modules.php"; nocase; content:"name=Forums"; content:"file=viewtopic"; pcre:"/forum=.*'/"; metadata:service http; reference:bugtraq,7193; classtype:web-application-attack; sid:2654; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-PHP xmlrpc.php post attempt"; flow:to_server,established; uricontent:"/xmlrpc.php"; nocase; pcre:"/^POST\s/smi"; metadata:service http; reference:bugtraq,14088; reference:cve,2005-1921; classtype:web-application-attack; sid:3827; rev:2;)# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP file upload directory traversal"; flow:established,to_server; content:"POST"; uricontent:"upload.php"; distance:0; nocase; pcre:"/^Content-Type\x3A\s+multipart\/form-data/smi"; content:"Content-Disposition|3A|"; distance:0; nocase; pcre:"/filename=\S*\x2e\x2e\x2f/Rsmi"; content:"|0A|"; distance:0; metadata:service http; reference:url,bugs.php.net/bug.php?id=28456; classtype:misc-attack; sid:5709; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP horde help module arbitrary command execution attempt"; flow:established,to_server; uricontent:"/services/help/"; pcre:"/[\?\x20\x3b\x26]module=[a-zA-Z0-9]*[^\x3b\x26]/U"; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:bugtraq,17292; reference:cve,2006-1491; classtype:web-application-attack; sid:6403; rev:4;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Wordpress cache_lastpostdate code injection attempt"; flow:to_server,established; content:"wp_filter"; pcre:"/cache_lastpostdate\[[^\]]+\]=[^\x00\x3B\x3D]{30}/smi"; metadata:service http; reference:bugtraq,14533; reference:cve,2005-2612; classtype:attempted-admin; sid:8708; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP cacti graph_image SQL injection attempt"; flow:to_server,established; uricontent:"graph_image.php"; nocase; pcre:"/rra_id=(?!(\d+|all|)([\x26\s]|$))/smi"; metadata:service http; reference:bugtraq,14128; reference:bugtraq,14129; reference:cve,2005-2148; classtype:web-application-attack; sid:8713; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP cacti graph_image SQL injection attempt"; flow:to_server,established; uricontent:"graph.php"; nocase; pcre:"/local_graph_id=(?!(\d+|)([\x26\s]|$))/smi"; metadata:service http; reference:bugtraq,14128; reference:bugtraq,14129; reference:cve,2005-2148; classtype:web-application-attack; sid:8716; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP cacti graph_image arbitrary command execution attempt"; flow:to_server,established; uricontent:"graph_image.php"; nocase; pcre:"/graph_(start|end|height|width)=(?!(\d+|)[\x26\s])/smi"; metadata:service http; reference:bugtraq,14042; reference:bugtraq,14129; reference:cve,2005-1524; classtype:web-application-attack; sid:8712; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP cacti graph_image SQL injection attempt"; flow:to_server,established; uricontent:"graph.php"; nocase; pcre:"/rra_id=(?!(\d+|all|)([\x26\s]|$))/smi"; metadata:service http; reference:bugtraq,14128; reference:bugtraq,14129; reference:cve,2005-2148; classtype:web-application-attack; sid:8715; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP cacti graph_image SQL injection attempt"; flow:to_server,established; uricontent:"graph_image.php"; nocase; pcre:"/local_graph_id=(?!(\d+|)([\x26\s]|$))/smi"; metadata:service http; reference:bugtraq,14128; reference:bugtraq,14129; reference:cve,2005-2148; classtype:web-application-attack; sid:8714; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Pajax arbitrary command execution attempt"; flow:established,to_server; content:"method"; nocase; pcre:"/\x22method\x22\s*\x3a\s*\x22[A-Z]\w*[^\x22]/smi"; metadata:service http; reference:bugtraq,17519; reference:cve,2006-1551; reference:cve,2006-1789; classtype:web-application-attack; sid:8734; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phpbb quick-reply.php arbitrary command attempt"; flow:established,to_server; uricontent:"/quick-reply.php"; content:"phpbb_root_path="; metadata:service http; reference:bugtraq,6173; classtype:web-application-attack; sid:1967; rev:3;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-PHP sphpblog upload_img_cgi access attempt"; flow:to_server,established; uricontent:"sphpblog"; uricontent:"upload_img_cgi.php"; metadata:service http; reference:bugtraq,14667; reference:cve,2005-2733; classtype:attempted-user; sid:11666; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-PHP vbulletin php code injection"; flow:to_server,established; uricontent:"misc.php"; pcre:"/template\s*=\s*\x7b\x24/sUmi"; metadata:service http; reference:cve,2005-0511; reference:url,marc.info/?l=bugtraq&m=110910899415763&w=2; classtype:attempted-user; sid:11668; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-PHP sphpblog install03_cgi access attempt"; flow:to_server,established; uricontent:"sphpblog"; uricontent:"install03_cgi.php"; metadata:service http; reference:bugtraq,14667; reference:cve,2005-2733; classtype:attempted-user; sid:11665; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP file upload GLOBAL variable overwrite attempt"; flow:to_server,established; content:"Content-Type|3A| multipart/form-data"; content:"name="; nocase; content:"GLOBALS"; within:7; distance:1; metadata:service http; reference:bugtraq,15250; reference:cve,2005-3390; classtype:web-application-attack; sid:12221; rev:2;)# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PHP function CRLF injection attempt"; flow:established,to_server; uricontent:".php"; uricontent:"|0A|"; metadata:service http; reference:bugtraq,5681; reference:cve,2002-1783; classtype:web-application-attack; sid:12360; rev:3;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-PHP sphpblog arbitrary file delete attempt"; flow:to_server,established; uricontent:"sphpblog"; uricontent:"comment_delete_cgi.php"; pcre:"/comment=[^\x26\s]*[\x2f\x5c]/sUmi"; metadata:service http; reference:bugtraq,14667; reference:cve,2005-2733; classtype:attempted-user; sid:11667; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-PHP sphpblog password.txt access attempt"; flow:to_server,established; uricontent:"sphpblog"; uricontent:"password.txt"; metadata:service http; reference:bugtraq,14667; reference:cve,2005-2733; classtype:attempted-user; sid:11664; rev:2;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phpBB viewtopic double URL encoding attempt"; flow:established,to_server; uricontent:"viewtopic.php"; uricontent:"highlight="; content:"%25"; metadata:service http; reference:cve,2004-1315; classtype:web-application-attack; sid:12610; rev:2;)