Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:AUDIT:UNWISE-CHAR-1 |
|---|---|
Severity |
Minor |
Recommended |
No |
Category |
HTTP |
Keywords |
Unwise Characters in URL Variable (1) |
Release Date |
2018/01/18 |
Update Number |
3028 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Unwise Characters in URL Variable (1)
This signature detects "unwise" characters in a URL, as defined by RFC-2396, "Uniform Resource Identifiers (URI): Generic Syntax". These characters may be an indication that SQL injection or other malicious activity may be occurring. It could also be the result of improper or poor web application design. If you are seeing a large number of hits on this signature to confirmed benign web applications, you may need to exempt those web applications until those web applications can be corrected. This is not a false positive, as the web application is failing to adhere to RFC standards.
Extended Description
PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includes_directory parameter.
Affected Products
- Katalog.hurricane katalog_stron_hurricane 1.3.5
References
- CVE: CVE-2014-8586
- CVE: CVE-2010-0795
- CVE: CVE-2010-0678
- CVE: CVE-2017-12500
- URL: http://www.ietf.org/rfc/rfc2396.txt