alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zhibang International ERP System SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|2f|SYSN|2f|json|2f|pcclient|2f|GetPersonalSealData|2e|ashx|3f|imageDate|3d|1|26|userId|3d|"; startswith; fast_pattern; pcre:"/(?:SELECT|UPDATE|DELETE|INSERT|CREATE|ALTER|DROP)/Ri"; reference:url,github.com/wy876/POC/blob/main/%E6%99%BA%E9%82%A6%E5%9B%BD%E9%99%85ERP-GetPersonalSealData.ashx%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md; classtype:attempted-admin; sid:2053444; rev:1; metadata:attack_target Server, created_at 2024_06_11, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2024_06_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)