alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Mambo Exploit"; flow:established,to_server; content:"mosConfig_absolute_path="; http_uri; content:".php"; nocase; http_uri; pcre:"/mosConfig_absolute_path=(https?|ftps?|php)\:\//Ui"; reference:url,seclists.org/lists/fulldisclosure/2005/Nov/0528.html; reference:url,isc.sans.org/diary.php?storyid=869; reference:url,www.us-cert.gov/cas/bulletins/SB07-106.html; classtype:web-application-attack; sid:2002681; rev:12; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)