SID 1:45406

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Possible Phpmyadmin CSRF exploitation attempt

Rule Explanation

This event is generated when malicious attacker tries to deceive a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc. using phpmyadmin web application Impact: Loss of information due to deletion of tables/ databases from the web applications Details: Ease of Attack: Simple. Attacker can craft attack very simply but attacker need to know the database/ table names. User interaction is needed as it is CSRF based attack

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group