""ET EXPLOIT Centreon 20.04 Authenticated RCE (CVE-2020-12688)""

SID: 2030338

Revision: 2

Class Type: attempted-admin

Metadata: attack_target Web_Server, created_at 2020_06_15, cve CVE_2020_12688, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2020_06_15

Reference:

• cve

• 2020-12688

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "GET"

• Value: "/main.get.php?p="

• Value: "&command_id="

• Value: "&command_name=../"

• Value: "|3b|&command_line="

Within:

PCRE:

Special Options:

• http_method

• http_uri

• http_uri

• http_uri

• fast_pattern

• http_uri

source