ET WEB_SPECIFIC_APPS WordPress wp-admin/admin.php Module Configuration Security Bypass Attempt

Query · suricata

flow:established,to_server;
http.uri;
content:"/wp-admin/admin.php"; nocase;
content:"page="; nocase; distance:0;
pcre:"/\x2Fwp\x2Dadmin\x2Fadmin\x2Ephp.+page\x3D(?:\x2Fcollapsing\x2Darchives\x2Foptions\x2Etxt|akismet\x2Freadme\x2Etxt|related\x2Dways\x2Dto\x2Dtake\x2Daction\x2Foptions\x2Ephp|wp\x2Dsecurity\x2Dscan\x2Fsecurityscan\x2Ephp)/i";
Raw source ET WEB_SPECIFIC_APPS WordPress wp-admin/admin.php Module Configuration Security Bypass Attempt · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET WEB_SPECIFIC_APPS WordPress wp-admin/admin.php Module Configuration Security Bypass Attempt";
    flow:established,to_server;
    http.uri;
    content:"/wp-admin/admin.php"; nocase;
    content:"page="; nocase; distance:0;
    pcre:"/\x2Fwp\x2Dadmin\x2Fadmin\x2Ephp.+page\x3D(?:\x2Fcollapsing\x2Darchives\x2Foptions\x2Etxt|akismet\x2Freadme\x2Etxt|related\x2Dways\x2Dto\x2Dtake\x2Daction\x2Foptions\x2Ephp|wp\x2Dsecurity\x2Dscan\x2Fsecurityscan\x2Ephp)/i";
    reference:url,www.securityfocus.com/bid/35584;
    reference:cve,2009-2334;
    classtype:web-application-attack;
    sid:2010728; rev:6;
    metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2010_07_30, cve CVE_2009_2334, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2020_11_07;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.