SigmaHQ/rules/web/web_cve_2010_1306_exploitation_attempt.yml
2021-09-23 14:51:59 +02:00

27 lines
853 B
YAML

title: CVE-2010-1306 Exploitation Attempt
id: 613ccec4-9812-4cc7-a2f5-bf88383cf83d
author: Subhash Popuri (@pbssubhash)
date: 2021/08/25
status: experimental
description: Joomla! Component Picasa 2.0 - Local File Inclusion:Directory traversal
vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla!
allows remote attackers to read arbitrary local files via a .. (dot dot) in the
controller parameter to index.php.
references:
- https://github.com/projectdiscovery/nuclei-templates
logsource:
category: webserver
detection:
selection:
c-uri|contains:
- /index.php?option=com_joomlapicasa2&controller=../../../../../etc/passwd%00
condition: selection
false_positives:
- Scanning from Nuclei
- Penetration Testing Activity
- Unknown
tags:
- attack.initial_access
- attack.t1190
level: critical