""ET EXPLOIT AirLive RCI HTTP Request""

SID: 2021408

Revision: 1

Class Type: attempted-admin

Metadata: created_at 2015_07_13, updated_at 2015_07_13

Reference:

• Link

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "GET"

• Value: "/cgi_test.cgi?write_"

Within:

PCRE: "/\?write_(?:m(?:ac|sn)|hdv|pid|tan)&[^&]*\x3b/Ui"

Special Options:

• http_method

• http_uri

source