Tag
Unusual Process Spawned from Web Server Parent
2 rules 2 TTPsThis rule detects unusual processes spawned from a web server parent process on Linux systems, potentially indicating an attacker attempting to establish persistence, execute malicious commands, or establish command and control channels.
FrankenPHP Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
2 rules 1 TTP 1 CVETwo distinct flaws in the `splitPos()` function in `cgi.go` allows an attacker to mislead FrankenPHP into treating a non-`.php` file as a `.php` script, leading to remote code execution where the attacker can control file content.
HiSecOS Web Server Privilege Escalation Vulnerability (CVE-2023-7342)
2 rules 1 TTP 1 CVECVE-2023-7342 allows authenticated users with operator or auditor roles in HiSecOS web server to escalate privileges to administrator by sending specially crafted packets, potentially granting full administrative access.
phpMyFAQ Unauthenticated FAQ Permission Bypass via Solution ID Enumeration
2 rules 1 TTPphpMyFAQ version 4.1.1 and earlier is vulnerable to an unauthenticated FAQ permission bypass, allowing attackers to enumerate solution IDs and discover restricted FAQ titles due to missing permission filters in key functions.