alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS FCMS familynews.php current_user_id Parameter Remote File Inclusion Attempt"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/familynews.php?"; nocase; uricontent:"current_user_id="; nocase; pcre:"/current_user_id=\s*(ftps?|https?|php)\:\//Ui"; reference:url,exploit-db.com/exploits/14965/; classtype:web-application-attack; sid:2011552; rev:1;)

Added 2011-10-12 19:32:16 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS FCMS familynews.php current_user_id Parameter Remote File Inclusion Attempt"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/familynews.php?"; nocase; uricontent:"current_user_id="; nocase; pcre:"/current_user_id=\s*(ftps?|https?|php)\:\//Ui"; classtype:web-application-attack; reference:url,exploit-db.com/exploits/14965/; sid:2011552; rev:1;)

Added 2011-02-04 17:31:22 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS FCMS familynews.php current_user_id Parameter Remote File Inclusion Attempt"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/familynews.php?"; nocase; uricontent:"current_user_id="; nocase; pcre:"/current_user_id=\s*(ftps?|https?|php)\:\//Ui"; classtype:web-application-attack; reference:url,exploit-db.com/exploits/14965/; reference:url,doc.emergingthreats.net/2011552; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SPECIFIC_APPS/WEB_FCMS; sid:2011552; rev:2;)

Added 2010-09-27 14:23:53 UTC