alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
msg:"ET WEB_SPECIFIC_APPS WordPress Contact Form Maker Plugin - SQL Injection 1";
flow:established,to_server;
http.uri;
content:"/wp-admin/admin-ajax.php?action=FormMakerSQLMapping_fmc"; nocase; fast_pattern;
http.request_body;
content:"name="; nocase;
pcre:"/^(?:[a-zA-Z0-9_%+])*(?:[\x2c\x22\x27\x28]|\x252[c278])/Ri";
reference:url,www.exploit-db.com/exploits/44854/;
classtype:web-application-attack;
sid:2025748; rev:3;
metadata:affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2018_06_26, deployment Datacenter, confidence High, signature_severity Major, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
)