ET EXPLOIT JCK Editor 6.4.4 SQLi Attempt (CVE-2018-17254)

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET EXPLOIT JCK Editor 6.4.4 SQLi Attempt (CVE-2018-17254)";
    flow:established,to_server;
    http.method;
    content:"GET"; nocase;
    http.uri;
    content:"/plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php"; nocase;
    content:"extension=menu"; distance:0;
    content:"view=menu"; nocase;
    content:"parent="; nocase;
    pcre:"/parent=[^&]*(?:S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)/Ui";
    reference:url,www.exploit-db.com/exploits/49627;
    reference:cve,2018-17254;
    classtype:attempted-admin;
    sid:2033604; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2021_07_28, cve CVE_2018_17254, deployment Perimeter, confidence High, signature_severity Major, tag Exploit, updated_at 2021_07_28;
)