alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Pandora FMS SQLi"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/pandora_console/mobile/index.php"; http.request_body; content:"action=login"; fast_pattern; content:"user="; distance:0; pcre:"/[^&]*(?:S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)/Ri"; reference:url,www.rapid7.com/db/modules/exploit/linux/http/pandora_fms_sqli; classtype:attempted-admin; sid:2019903; rev:4; metadata:created_at 2014_12_10, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_14;)