SID 1:50343

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Schneider Electric U.Motion Builder command injection attempt

Rule Explanation

This event is generated when a command injection attempt against Scheider Electric U.Motion Builder devices is detected. Impact: Web Application Attack Details: The script "track_import_export.php" is vulnerable to an unauthenticated command injection vulnerability when user-supplied input to the HTTP GET/POST parameter "object_id" is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to inject arbitrary commands into a PHP exec call. Ease of Attack: Simple, a public proof of concept exists.

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group