Rule History

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Wordpress Arbitrary File Deletion 1"; flow:established,to_server; http.uri; content:"/wp-admin/post.php?post="; http.request_body; content:"action=editattachment&_wpnonce="; fast_pattern; content:"&thumb=../../"; reference:url,exploit-db.com/exploits/44949/; classtype:attempted-user; sid:2025757; rev:3; metadata:affected_product Wordpress, attack_target Web_Server, created_at 2018_06_27, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2020_08_25;)