PHP: improve message for script upload with superfluous extension

lifeforms · lifeforms · commit 26441490d2e3 · 2017-09-15T22:44:52.000+02:00
diff --git a/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf b/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
@@ -608,7 +608,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
 # This rule is a stricter sibling of rule 933110.
 #
 SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:php\d*|phps|phtml)\..*$" \
-    "msg:'PHP Injection Attack: PHP Script File Upload Found',\
+    "msg:'PHP Injection Attack: PHP Script File With Superfluous Extension Found',\
     phase:2,\
     ver:'OWASP_CRS/3.0.0',\
     t:none,t:lowercase,\

Original file line number	Diff line number	Diff line change
`@@ -608,7 +608,7 @@ SecRule REQUEST_COOKIES\|!REQUEST_COOKIES:/__utm/\|REQUEST_COOKIES_NAMES\|REQUEST_F`
`608`	`608`	`# This rule is a stricter sibling of rule 933110.`
`609`	`609`	`#`
`610`	`610`	`SecRule FILES\|REQUEST_HEADERS:X-Filename\|REQUEST_HEADERS:X_Filename\|REQUEST_HEADERS:X-File-Name "@rx .\.(?:php\d\|phps\|phtml)\..*$" \`
`611`		`- "msg:'PHP Injection Attack: PHP Script File Upload Found',\`
	`611`	`+ "msg:'PHP Injection Attack: PHP Script File With Superfluous Extension Found',\`
`612`	`612`	`phase:2,\`
`613`	`613`	`ver:'OWASP_CRS/3.0.0',\`
`614`	`614`	`t:none,t:lowercase,\`