""ET WEB_SPECIFIC_APPS Joomla 3.7.0 - Sql Injection (CVE-2017-8917)""

SID: 2024342

Revision: 2

Class Type: web-application-attack

Metadata: affected_product Joomla, attack_target Web_Server, created_at 2017_06_01, cve CVE_2017_8917, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2017_06_02, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application

Reference:

• cve

• 2017-8917

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: ".php?"

• Value: "option="

• Value: "view="

• Value: "layout="

• Value: "&list[fullordering]="

Within:

PCRE: "/&list[fullordering]=(?:[a-zA-Z0-9])*[\x22\x27\x28]/Ui"

Special Options:

• http_uri

• http_uri

• http_uri

• http_uri

• http_uri

source