""ET EXPLOIT ZKBioSecurity SQL Injection Attempt (CVE-2022-36635)""

SID: 2039129

Revision: 1

Class Type: attempted-admin

Metadata: affected_product IoT, attack_target IoT, created_at 2022_10_07, cve CVE_2022_36635, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence High, signature_severity Major, updated_at 2022_10_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application

Reference:

• cve

• 2022-36635

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: [$HTTP_PORTS,8098]

Flow: established,to_server

Contents:

• Value: "POST /baseOpLog.do HTTP/" Depth: 24

• Value: "|0d 0a 0d 0a|"

• Value: "opTime"

• Value: "|27|"

• Value: "|2f 2a|"

• Value: "|2a 2f|"

Within: 200

PCRE: "/^(?:Begin|End)\=/R"

Special Options:

• fast_pattern

source