CVE-2013-4547 Exploitation Attempt

Detects CVE-2013-4547

Sigma rule (View on GitHub)

 1title: CVE-2013-4547 Exploitation Attempt
 2id: 545860c7-97e3-40a4-8e4f-c0109d7ad1ea
 3status: experimental
 4description: Detects CVE-2013-4547
 5references:
 6  - https://www.exploit-db.com/exploits/38846
 7author: Loginsoft Research Unit
 8date: 2020/05/29
 9logsource:
10  product: nginx
11  category: webserver
12detection:
13  selection:
14    c-uri|contains: '\x00.php'
15    sc-status:
16      - 200
17      - 400
18  condition: selection
19falsepositives:
20    - Unknown
21level: medium```

References

to-top