ET EXPLOIT Zhibang International ERP System SQL Injection Attempt

alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET EXPLOIT Zhibang International ERP System SQL Injection Attempt";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"|2f|SYSN|2f|json|2f|pcclient|2f|GetPersonalSealData|2e|ashx|3f|imageDate|3d|1|26|userId|3d|"; startswith; fast_pattern;
    pcre:"/(?:SELECT|UPDATE|DELETE|INSERT|CREATE|ALTER|DROP)/Ri";
    reference:url,github.com/wy876/POC/blob/main/%E6%99%BA%E9%82%A6%E5%9B%BD%E9%99%85ERP-GetPersonalSealData.ashx%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md;
    classtype:attempted-admin;
    sid:2053444; rev:1;
    metadata:attack_target Server, created_at 2024_06_11, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2024_06_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
)