""ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 24""
SID: 2019445
Revision: 1
Class Type: web-application-attack
Metadata: created_at 2014_10_16, cve CVE_2014_3704, updated_at 2014_10_16
Reference:
Protocol: tcp
Source Network: any
Source Port: any
Destination Network: $HTTP_SERVERS
Destination Port: $HTTP_PORTS
Flow: established,to_server
Contents:
- Value: "%6ea%6d%65%5b"
Within:
PCRE: "/(?:^|&|Content-Disposition[\x3a][^\n]?name\s?=\s?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]?\W/Pi"
Special Options:
-
nocase
-
http_client_body