# http://www.atomicorp.com/
# Atomicorp (Gotroot.com) ModSecurity rules
# Just In Time Patches for Vulnerable Applications Rules for modsec 2.x
#
# Created by the Prometheus Group (http://www.prometheus-group.com)
# Copyright 2005,2006 and 2007 by the Prometheus Group, all rights reserved.
# Redistribution is strictly prohibited in any form, including whole or in part.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS   
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE   
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE   
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE   
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR   
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF   
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS   
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN   
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)   
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF   
# THE POSSIBILITY OF SUCH DAMAGE.



#--------------------------------
# notes
#--------------------------------
# Rules work with modsecurity 2.x and above only

#--------------------------------
#start rules
#--------------------------------

# Phase 2 rules
#
SecDefaultAction "log,deny,auditlog,phase:2,status:403,t:lowercase"

# Rule 310000: WEB-CGI formmail
SecRule REQUEST_URI "/(?:formmail|mailform)(?:\x0a|\.pl\x0a)"  \
        "id:310000,rev:1,severity:2,msg:'JITP: web-cgi formmail'"


# Rule 310001: pals-cgi arbitrary file access attempt
SecRule REQUEST_URI "/pals-cgi.*documentName=" \
        "id:310001,rev:1,severity:2,msg:'JITP: pals-cgi arbitary file access attempt'"


# Rule 310002:  WEB-CGI phf arbitrary command execution attempt
SecRule REQUEST_URI "/phf"  \
        "id:310002,rev:1,severity:2,msg:'JITP: phf arbitrary command execution attempt',chain"
SecRule REQUEST_URI "\x0a/"

# Rule 310003:  WEB-CGI phf access
SecRule REQUEST_URI "/phf\?" \
        "id:310003,rev:1,severity:2,msg:'JITP: phf access'"

# Rule 310004:  WEB-CGI htsearch arbitrary file read attempt
SecRule REQUEST_URI "/htsearch\?exclude=\`"  \
        "id:310004,rev:1,severity:2,msg:'JITP: tsearch arbitrary file read attempt'"

# Rule 310005:  WEB-CGI csSearch.cgi arbitrary command execution attempt
SecRule REQUEST_URI "/csSearch\.cgi\?" \
        "id:310005,rev:1,severity:2,msg:'JITP: csSearch.cgi arbitrary command execution attempt',chain"
SecRule REQUEST_URI "\`" 

# Rule 310006:  WEB-CGI FormHandler.cgi directory traversal attempt attempt
SecRule REQUEST_URI "/FormHandler\.cgi" \
        "id:310006,rev:1,severity:2,msg:'JITP: FormHandler.cgi directory traversal attempt attempt',,chain"
SecRule REQUEST_URI "/\.\./" 

# Rule 310007: WEB-CGI FormHandler.cgi external site redirection attempt
SecRule REQUEST_URI "/FormHandler\.cgi" \
        "id:310007,rev:1,severity:2,msg:'JITP: FormHandler.cgi external site redirection attempt',chain"
SecRule REQUEST_URI "redirect=http" 

# Rule 310008: WEB-PHP squirrel mail spell-check arbitrary command attempt
SecRule REQUEST_URI "/squirrelspell/modules/check_me\.mod\.php" \
        "id:310008,rev:1,severity:2,msg:'JITP: squirrel mail spell-check arbitrary command attempt',,chain"
SecRule REQUEST_URI "SQSPELL_APP\[" 

# Rule 310009: WEB-PHP squirrel mail theme arbitrary command attempt
SecRule REQUEST_URI "/left_main\.php" \
        "id:310009,rev:1,severity:2,msg:'JITP: squirrel mail theme arbitrary command attempt',chain"
SecRule REQUEST_URI "cmdd=" 

# Rule 310010: WEB-PHP directory.php arbitrary command attempt
SecRule REQUEST_URI "/directory\.php\?" \
        "id:310010,rev:1,severity:2,msg:'JITP: directory.php arbitrary command attempt',chain"
SecRule REQUEST_URI "\;" 

# Rule 310011: WEB-PHP PHPLIB remote commanSelective REQUEST_URI|REQUEST_BODY
#	attempt
SecRule REQUEST_URI|REQUEST_BODY "_PHPLIB\[libdir\]" \
        "id:310011,rev:1,severity:2,msg:'JITP: PHPLIB remote commanSelective REQUEST_URI|REQUEST_BODYd attempt'"

# Rule 310012: WEB-PHP PHPLIB remote command attempt
SecRule REQUEST_URI   "/db_mysql\.inc" \
        "id:310012,rev:1,severity:2,msg:'JITP: PHPLIB remote command attempt'"

# Rule 310013: Exploit phpBB Highlighting Code Execution Attempt
SecRule REQUEST_URI|REQUEST_BODY "(?:\;|\&)highlight=\'\.system\(" \
        "id:310013,rev:1,severity:2,msg:'JITP: phpBB Highlighting Code Execution Attempt'"

# Rule 310014: Exploit phpBB Highlighting SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "&highlight=\'\.mysql_query\("  \
        "id:310014,rev:1,severity:2,msg:'JITP: phpBB Highlighting SQL Injection'"

# Rule 310015: Exploit phpBB Highlighting Code Execution - Santy.A Worm
SecRule REQUEST_URI|REQUEST_BODY "&highlight=\'\.fwrite\(fopen\(" \
        "id:310015,rev:1,severity:2,msg:'JITP: phpBB Highlighting SQL Injection - Santy.A Worm'"

# Rule 310016: Exploit phpBB Highlight Exploit Attempt
SecRule REQUEST_URI|REQUEST_BODY "&highlight=\x2527\x252Esystem\(" \
        "id:310016,rev:1,severity:2,msg:'JITP: phpBB Highlight Exploit Attempt'"

# Rule 310017: WEB-CGI dcforum.cgi directory traversal attempt
SecRule REQUEST_URI "/dcforum\.cgi" \
        "id:310017,rev:1,severity:2,msg:'JITP: dcforum.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "forum=\.\./\.\." 

# Rule 310018: WEB-CGI dcboard.cgi invalid user addition attempt
SecRule REQUEST_URI "/dcboard\.cgi.*\|admin" \
        "id:310018,rev:1,severity:2,msg:'JITP: dcboard.cgi invalid user addition attempt'"

# Rule 310019: WEB-CGI alchemy http server PRN arbitrary command execution
#	attempt
SecRule REQUEST_URI|REQUEST_BODY "/PRN/\.\./\.\./"  \
        "id:310019,rev:1,severity:2,msg:'JITP: alchemy http server PRN arbitrary command execution attempt'"

# Rule 310020: PHP Doc System Local File Inclusion Vulnerability
SecRule REQUEST_URI  "/index\.php" \
        "id:310020,rev:1,severity:2,msg:'JITP: Doc System Local File Inclusion Vulnerability',chain"
SecRule ARGS:show "(?:\.\./\.\.|/)"

# Rule 310021: WEB-CGI alchemy http server NUL arbitrary command execution
#	attempt
SecRule REQUEST_URI|REQUEST_BODY "/NUL/\.\./\.\./" \
        "id:310021,rev:1,severity:2,msg:'JITP: alchemy http server NUL arbitrary command execution attempt'"

# Rule 310022: WEB-CGI AltaVista Intranet Search directory traversal attempt
SecRule REQUEST_URI "/query\?mss=\.\."  \
        "id:310022,rev:1,severity:2,msg:'JITP: AltaVista Intranet Search directory traversal attempt'"

# Rule 310023: WEB-CGI hello.bat arbitrary command execution attempt
SecRule REQUEST_URI "/hello\.bat"  \
        "id:310023,rev:1,severity:2,msg:'JITP: hello.bat arbitrary command execution attempt',chain"
SecRule REQUEST_URI "\&" 

# Rule 310024: WEB-CGI Home Free search.cgi directory traversal attempt
SecRule REQUEST_URI "/search\.cgi" \
        "id:310024,rev:1,severity:2,msg:'JITP: Home Free search.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "letter=\.\./\.\." 

# Rule 310025:campus attempt
SecRule REQUEST_URI "/campus\?\|0A\|" \
        "id:310025,rev:1,severity:2,msg:'JITP: campus attempt',chain"
SecRule REQUEST_URI "letter=\.\./\.\." 

# Rule 310026: WEB-CGI pfdispaly.cgi arbitrary command execution attempt
SecRule REQUEST_URI "/pfdispaly\.cgi\?\'"  \
        "id:310026,rev:1,severity:2,msg:'JITP: pfdispaly.cgi arbitrary command execution attempt'"

# Rule 310027: WEB-CGI talkback.cgi directory traversal attempt
SecRule REQUEST_URI "/talkbalk\.cgi" \
        "id:310027,rev:1,severity:2,msg:'JITP: talkback.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "article=\.\./\.\./" 

# Rule 310028: WEB-CGI technote main.cgi file directory traversal attempt
SecRule REQUEST_URI "/technote/main\.cgi" \
        "id:310028,rev:1,severity:2,msg:'JITP: technote main.cgi file directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./\.\./" 

# Rule 310029: WEB-CGI technote print.cgi directory traversal attempt
SecRule REQUEST_URI "/technote/print\.cgi.*\x00" \
        "id:310029,rev:1,severity:2,msg:'JITP: technote print.cgi directory traversal attempt'"

# Rule 310030: WEB-CGI eXtropia webstore directory traversal
SecRule REQUEST_URI "/web_store\.cgi" \
        "id:310030,rev:1,severity:2,msg:'JITP: eXtropia webstore directory traversal',chain"
SecRule REQUEST_URI "page=\.\./" 

# Rule 310031: WEB-CGI shopping cart directory traversal
SecRule REQUEST_URI "/shop\.cgi" \
        "id:310031,rev:1,severity:2,msg:'JITP: shopping cart directory traversal',chain"
SecRule REQUEST_URI "page=\.\./" 

# Rule 310032: WEB-CGI Allaire Pro Web Shell attempt
SecRule REQUEST_URI "/authenticate\.cgi\?PASSWORD" \
        "id:310032,rev:1,severity:2,msg:'JITP: Allaire Pro Web Shell attempt',chain"
SecRule REQUEST_URI "config\.ini" 

# Rule 310033: WEB-CGI Armada Style Master Index directory traversal
SecRule REQUEST_URI "/search\.cgi\?keys" \
        "id:310033,rev:1,severity:2,msg:'JITP: Armada Style Master Index directory traversal',chain"
SecRule REQUEST_URI "catigory=\.\./" 

# Rule 310034: WEB-CGI cached_feed.cgi moreover shopping cart directory
#	traversal
SecRule REQUEST_URI "/cached_feed\.cgi" \
        "id:310034,rev:1,severity:2,msg:'JITP: cached_feed.cgi moreover shopping cart directory traversal',chain"
SecRule REQUEST_URI "\.\./" 

# Rule 310035: WEB-CGI Talentsoft Web+ exploit attempt
SecRule REQUEST_URI "/webplus\.cgi\?Script=/webplus/webping/webping\.wml" \
        "id:310035,rev:1,severity:2,msg:'JITP: Talentsoft Web+ exploit attempt'"

# Rule 310036: WEB-CGI txt2html.cgi directory traversal attempt
SecRule REQUEST_URI "/txt2html\.cgi" \
        "id:310036,rev:1,severity:2,msg:'JITP: txt2html.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "/\.\./\.\./\.\./\.\./" 

# Rule 310037: WEB-CGI store.cgi directory traversal attempt
SecRule REQUEST_URI "/store\.cgi" \
        "id:310037,rev:1,severity:2,msg:'JITP: store.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./" 

# Rule 310038: WEB-CGI mrtg.cgi directory traversal attempt
SecRule REQUEST_URI "/mrtg\.cgi" \
        "id:310038,rev:1,severity:2,msg:'JITP: mrtg.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "cfg=/\.\./" 

# Rule 310039: WEB-CGI CCBill whereami.cgi arbitrary command execution attempt
SecRule REQUEST_URI "/whereami\.cgi\?g="  \
        "id:310039,rev:1,severity:2,msg:'JITP: CCBill whereami.cgi arbitrary command execution attempt'"

# Rule 310040: WEB-CGI WhatsUpGold instancename overflow attempt
SecRule REQUEST_URI "/_maincfgret\.cgi"  \
        "id:310040,rev:1,severity:2,msg:'JITP: WhatsUpGold instancename overflow attempt'"

# Rule 310041:Demarc SQL injection attempt
SecRule REQUEST_URI "/dm/demarc.*s_key=.*\'" \
        "id:310041,rev:1,severity:2,msg:'JITP: Demarc SQL injection attempt'"

# Rule 310042: WEB-MISC apache directory disclosure attempt
SecRule REQUEST_URI|REQUEST_BODY "////////"  \
        "id:310042,rev:1,severity:2,msg:'JITP: apache directory disclosure attempt'"

# Rule 310043: WEB-MISC htgrep attempt
SecRule REQUEST_URI "/htgrep" \
        "id:310043,rev:1,severity:2,msg:'JITP: htgrep attempt',chain"
SecRule REQUEST_URI "hdr=/" 

# Rule 310044:musicat empower attempt
SecRule REQUEST_URI "/empower\?DB=" \
        "id:310044,rev:1,severity:2,msg:'JITP: musicat empower attempt'"

# Rule 310045: WEB-PHP DNSTools administrator authentication bypass attempt
SecRule REQUEST_URI "/dnstools\.php" \
        "id:310045,rev:1,severity:2,msg:'JITP: DNSTools administrator authentication bypass attempt',chain"
SecRule REQUEST_URI "user_dnstools_administrator=true" 

# Rule 310046: WEB-PHP DNSTools authentication bypass attempt
SecRule REQUEST_URI "/dnstools\.php" \
        "id:310046,rev:1,severity:2,msg:'JITP: DNSTools authentication bypass attempt',chain"
SecRule REQUEST_URI "user_logged_in=true" 

# Rule 310047:General phpbb_root_path vulnerabilities
SecRule ARGS:phpbb_root_path "(?:(?:ht|f)tps?\:/|\.\./)" \
        "id:310047,rev:1,severity:2,msg:'JITP: Generic phpbb_root_path exploit'"

# Rule 310048: WEB-PHP phpbb quick-reply.php arbitrary command attempt
SecRule REQUEST_URI "/quick-reply\.php" \
        "id:310048,rev:1,severity:2,msg:'JITP: phpbb quick-reply.php arbitrary command attempt',chain"
SecRule REQUEST_URI "phpbb_root_path=" 

# Rule 310049: WEB-PHP Blahz-DNS dostuff.php modify user attempt
SecRule REQUEST_URI "/dostuff\.php\?action=modify_user" \
        "id:310049,rev:1,severity:2,msg:'JITP: Blahz-DNS dostuff.php modify user attempt'"

# Rule 310050: WEB-PHP PHP-Wiki cross site scripting attempt
SecRule REQUEST_URI "/modules\.php\?*name=Wiki*\<*(script|about|applet|activex|chrome)*\>" \
        "id:310050,rev:1,severity:2,msg:'JITP: PHP-Wiki cross site scripting attemptt'"

# Rule 310051: WEB-MISC *%0a.pl access
SecRule REQUEST_URI "/*\x0a\.pl"  \
        "id:310051,rev:1,severity:2,msg:'JITP: *%0a.pl access'"

# Rule 310052: WEB-PHP strings overflow
SecRule REQUEST_URI|REQUEST_BODY "\?STRENGUR"  \
        "id:310052,rev:1,severity:2,msg:'JITP: strings overflow'"

# Rule 310053: WEB-PHP shoutbox.php directory traversal attempt
SecRule REQUEST_URI "/shoutbox\.php" \
        "id:310053,rev:1,severity:2,msg:'JITP: shoutbox.php directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./" 

# Rule 310054: WEB-PHP b2 cafelog gm-2-b2.php remote file include attempt
SecRule REQUEST_URI "/gm-2-b2\.php" \
        "id:310054,rev:1,severity:2,msg:'JITP: b2 cafelog gm-2-b2.php remote file include attempt',chain"
SecRule REQUEST_URI "b2inc=(?:http|https|ftp)\:/" 

# Rule 310055: WEB-PHP BLNews objects.inc.php4 remote file include attempt
SecRule REQUEST_URI "/objects\.inc\.php*" \
        "id:310055,rev:1,severity:2,msg:'JITP: BLNews objects.inc.php4 remote file include attempt',chain"
SecRule REQUEST_URI "Server\[path\]=(?:http|https|ftp)\:/" 

# Rule 310056: WEB-PHP ttCMS header.php remote file include attempt
SecRule REQUEST_URI "/admin/templates/header\.php" \
        "id:310056,rev:1,severity:2,msg:'JITP: ttCMS header.php remote file include attempt'"
SecRule REQUEST_URI "admin_root=(?:http|https|ftp)\:/" 

# Rule 310057: WEB-PHP autohtml.php directory traversal attempt
SecRule REQUEST_URI "/autohtml\.php" \
        "id:310057,rev:1,severity:2,msg:'JITP: autohtml.php directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./\.\./" 

# Rule 310058: WEB-PHP ttforum remote file include attempt
SecRule REQUEST_URI "forum/index\.php" \
        "id:310058,rev:1,severity:2,msg:'JITP: ttforum remote file include attempt',chain"
SecRule REQUEST_URI "template=" 

# Rule 310059: WEB-PHP pmachine remote file include attempt
SecRule REQUEST_URI "lib\.inc\.php" \
        "id:310059,rev:1,severity:2,msg:'JITP: pmachine remote file include attempt',chain"
SecRule REQUEST_URI "pm_path=(?:http|https|ftp)\:/" 

# Rule 310060: WEB-PHP pmachine remote file include attempt
SecRule REQUEST_URI "lib\.inc\.php.*pm_path.*(?:http|https|ftp)\:/" \
        "id:310060,rev:1,severity:2,msg:'JITP: pmachine remote file include attempt'"

# Rule 310061:rolis guestbook remote file include attempt
SecRule REQUEST_URI "/insert\.inc\.php*path=" \
        "id:310061,rev:1,severity:2,msg:'JITP: guestbook remote file include attempt'"

# Rule 310062: IdeaBox cord.php file include
SecRule REQUEST_URI "/index\.php*ideaDir*cord\.php" \
        "id:310062,rev:1,severity:2,msg:'JITP: IdeaBox cord.php file include'"

# Rule 310063:IdeaBox notification.php file include
SecRule REQUEST_URI "/index\.php*gorumDir*notification\.php" \
        "id:310063,rev:1,severity:2,msg:'JITP: IdeaBox notification.php file include'"

# Rule 310064: WEB-PHP DCP-Portal remote file include attempt
SecRule REQUEST_URI "/library/lib\.php" \
        "id:310064,rev:1,severity:2,msg:'DCP-Portal remote file include attempt',chain"
SecRule REQUEST_URI "root=" 

# Rule 310065: WEB-PHP IdeaBox cord.php file include
SecRule REQUEST_URI "/index\.php" \
        "id:310065,rev:1,severity:2,msg:'JITP: IdeaBox cord.php file include',chain"
SecRule REQUEST_URI "cord\.php" 

# Rule 310066: WEB-PHP IdeaBox notification.php file include
SecRule REQUEST_URI "/index\.php" \
        "id:310066,rev:1,severity:2,msg:'JITP: IdeaBox notification.php file include',chain"
SecRule REQUEST_URI "notification\.php" 

# Rule 310067: WEB-PHP Invision Board emailer.php file include
SecRule REQUEST_URI "/ad_member\.php" \
        "id:310067,rev:1,severity:2,msg:'JITP: Invision Board emailer.php file include',chain"
SecRule REQUEST_URI "emailer\.php" 

# Rule 310068: WEB-PHP WebChat db_mysql.php file include
SecRule REQUEST_URI "/defines\.php" \
        "id:310068,rev:1,severity:2,msg:'JITP: WebChat db_mysql.php file include',chain"
SecRule REQUEST_URI "db_mysql\.php" 

# Rule 310069: WEB-PHP WebChat english.php file include
SecRule REQUEST_URI "/defines\.php" \
        "id:310069,rev:1,severity:2,msg:'JITP: WebChat english.php file include',chain"
SecRule REQUEST_URI "english\.php" 

# Rule 310070: WEB-PHP Typo3 translations.php file include
SecRule REQUEST_URI "/translations\.php" \
        "id:310070,rev:1,severity:2,msg:'JITP: Typo3 translations.php file include',chain"
SecRule REQUEST_URI "ONLY=\x2e" 

# Rule 310071: WEB-PHP news.php file include
SecRule REQUEST_URI "/news\.php" \
        "id:310071,rev:1,severity:2,msg:'JITP: news.php file include',chain"
SecRule REQUEST_URI "template" 

# Rule 310072: WEB-PHP YaBB SE packages.php file include
SecRule REQUEST_URI "/packages\.php" \
        "id:310072,rev:1,severity:2,msg:'JITP: YaBB SE packages.php file include',chain"
SecRule REQUEST_URI "packer\.php" 

# Rule 310073: WEB-PHP newsPHP Language file include attempt
SecRule REQUEST_URI "/nphpd\.php" \
        "id:310073,rev:1,severity:2,msg:'JITP: newsPHP Language file include attempt',chain"
SecRule REQUEST_URI "LangFile" 

# Rule 310074:myphpPagetool pt_config.inc file include
SecRule REQUEST_URI "/doc/admin*ptinclude*pt_config\.inc" \
        "id:310074,rev:1,severity:2,msg:'JITP: myphpPagetool pt_config.inc file include'"

# Rule 310075:Invision Board ipchat.php file include
SecRule REQUEST_URI "/ipchat\.php*root_path*conf_global\.php" \
        "id:310075,rev:1,severity:2,msg:'JITP: Invision Board ipchat.php file include'"

# Rule 310076: WEB-PHP PhpGedView PGV authentication_index.php base directory
#	manipulation attempt
SecRule REQUEST_URI "/authentication_index\.php" \
        "id:310076,rev:1,severity:2,msg:'JITP: PhpGedView PGV authentication_index.php base directory manipulation attempt',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY=(?:http|https|ftp)\:/" 

# Rule 310077: WEB-PHP PhpGedView PGV functions.php base directory manipulation
#	attempt
SecRule REQUEST_URI "/functions\.php" \
        "id:310077,rev:1,severity:2,msg:'JITP: PhpGedView PGV functions.php base directory manipulation attempt',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY" 

# Rule 310078: WEB-PHP TUTOS path disclosure attempt
SecRule REQUEST_URI "/note_overview\.php" \
        "id:310078,rev:1,severity:2,msg:'JITP: TUTOS path disclosure attempt',chain"
SecRule REQUEST_URI "id=" 

# Rule 310079: WEB-PHP PhpGedView PGV base directory manipulation
SecRule REQUEST_URI "_conf\.php" \
        "id:310079,rev:1,severity:2,msg:'JITP: PhpGedView PGV base directory manipulation',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY" 

# Rule 310080:PHPBB worm sigs
SecRule ARGS:highlight "(?:\x27|%27|\x2527|%2527)" \
        "id:310080,rev:1,severity:2,msg:'JITP: PHPBB worm'"

# Rule 310081:Mailto domain search possible MyDoom.M,O
SecRule REQUEST_URI "/search\?hl=en&ie=UTF-8&oe=UTF-8&q=mailto\+" \
        "id:310081,rev:1,severity:2,msg:'JITP: Mailto domain search possible MyDoom.M,O',chain"
SecRule REQUEST_URI "Host\: www\.google\.com" 

# Rule 310082:WEB-PHP EasyDynamicPages exploit
SecRule REQUEST_URI "edp_relative_path=" \
        "id:310082,rev:1,severity:2,msg:'JITP: phf access'"

# Rule 310083:Calendar XSS
SecRule REQUEST_URI "/(?:calendar|setup).php\?phpc_root_path=(?:(?:http|https|ftp)\:/|<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>)" \
        "id:310083,rev:1,severity:2,msg:'JITP: Calendar XSS'"

# Rule 310084:phpMyAdmin Export.PHP File Disclosure Vulnerability
SecRule SCRIPT_FILENAME "export\.php$" \
        "id:310084,rev:1,severity:2,msg:'JITP: phpMyAdmin Export.PHP File Disclosure Vulnerability',chain"
SecRule ARGS:what "\.\." 

# Rule 310085:nmap version request
SecRule REQUEST_URI|REQUEST_BODY "^(?:HELP|default|\||TNMP|DmdT|\:)$"  \
        "id:310085,rev:1,severity:2,msg:'JITP: nmap version request'"

# Rule 310086:More PHPBB worms
SecRule REQUEST_URI "/viewtopic\.php\?" \
        "id:310086,rev:1,severity:2,msg:'JITP: PHPBB worm',chain"
SecRule ARGS "(?:chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(?:(?:[0-9a-fA-Fx]{1,3})\)" 

# Rule 310087: TIKIWIKI
SecRule REQUEST_URI  "/tiki-map.phtml\?mapfile=\.\./\.\./" \
        "id:310087,rev:1,severity:2,msg:'JITP: TikiWiki directory traversal'"

# Rule 310088: WEB-MISC BitKeeper arbitrary command attempt
SecRule REQUEST_URI "/diffs/" \
        "id:310088,rev:1,severity:2,msg:'JITP: BitKeeper arbitrary command attempt',chain"
SecRule REQUEST_URI "\'" 

# Rule 310089:awstats probe
SecRule REQUEST_URI|REQUEST_BODY  "/awstats\.pl HTTP\/(?:0\.9|1\.0|1\.1)$" \
	"id:310089,rev:1,severity:2,msg:'JITP: Awstats.pl probe'" 

# Rule 310090:/forum/viewtopic.php?x=http://
SecRule REQUEST_URI "/forum/viewtopic\.php\?x=(?:http|https|ftp)\:/" \
        "id:310090,rev:1,severity:2,msg:'JITP: Forum remote include attempt'"

# Rule 310091: WEB-MISC Crystal Reports crystalImageHandler.aspx directory
#	traversal attempt
SecRule REQUEST_URI "/crystalimagehandler\.aspx" \
        "id:310091,rev:1,severity:2,msg:'JITP: Crystal Reports crystalImageHandler.aspx directory traversal attempt',chain"
SecRule REQUEST_URI "dynamicimage=\.\./" 

# Rule 310092:mailman 2.x path recursion attack
SecRule REQUEST_URI|REQUEST_BODY "mailman/private/.*\.\.\./\.\.\.\.///"  \
        "id:310092,rev:1,severity:2,msg:'JITP: mailman 2.x path recursion attack',chain"
SecRule REQUEST_URI|REQUEST_BODY "/mailman/.*\.\.\./"

# Rule 310093:ftp.pl attempt
SecRule REQUEST_URI "/ftp\.pl\?dir=\.\./\.\." \
        "id:310093,rev:1,severity:2,msg:'JITP: ftp.pl directory traversal attempt'"

# Rule 310094:Tomcat server snoop access
SecRule REQUEST_URI "/jsp/snp/.*\.snp" \
        "id:310094,rev:1,severity:2,msg:'JITP: Tomcat server snoop access'"

# Rule 310095: WEB-CGI HyperSeek hsx.cgi directory traversal attempt
SecRule REQUEST_URI "/hsx\.cgi.*\x00" \
        "id:310095,rev:1,severity:2,msg:'JITP: HyperSeek hsx.cgi directory traversal attempt'"

# Rule 310096: WEB-CGI SWSoft ASPSeek Overflow attempt
SecRule REQUEST_URI "/s\.cgi" \
        "id:310096,rev:2,severity:2,msg:'JITP: SWSoft ASPSeek Overflow attempt',chain"
SecRule REQUEST_URI "tmpl="

# Rule 310097: WEB-CGI /wwwboard/passwd.txt access
SecRule REQUEST_URI "/wwwboard/passwd\.txt" \
        "id:310097,rev:1,severity:2,msg:'JITP: /wwwboard/passwd.txt access'"

# Rule 310098: WEB-CGI webplus directory traversal
SecRule REQUEST_URI "/webplus\?script" \
        "id:310098,rev:2,severity:2,msg:'JITP: webplus directory traversal',chain"
SecRule REQUEST_URI "\.\./"

# Rule 310099: WEB-CGI websendmail access
SecRule REQUEST_URI "/websendmail" \
        "id:310099,rev:1,severity:2,msg:'JITP: websendmail access'"

# Rule 310100: WEB-CGI anaconda directory transversal attempt
SecRule REQUEST_URI "/(?:apexec|anacondaclip)\.pl" \
        "id:310100,rev:1,severity:2,msg:'JITP: anaconda directory transversal attempt', chain"
SecRule REQUEST_URI "template=\.\./"

# Rule 310101: WEB-CGI imagemap.exe overflow attempt
SecRule REQUEST_URI "/imagemap\.exe\?" \
        "id:310101,rev:1,severity:2,msg:'imagemap.exe overflow attempt'"


# Rule 310102: WEB-CGI htmlscript attempt
SecRule REQUEST_URI "/htmlscript\?\.\./\.\." \
        "id:310102,rev:1,severity:2,msg:'JITP: htmlscript directory traversal attempt'"

# Rule 310103: WEB-CGI nph-test-cgi access
SecRule REQUEST_URI "/nph-test-cgi" \
        "id:310103,rev:1,severity:2,msg:'JITP: nph-test-cgi access'"


# Rule 310104: WEB-CGI rwwwshell.pl access
SecRule REQUEST_URI "/rwwwshell\.pl" \
        "id:310104,rev:1,severity:2,msg:'JITP: rwwwshell.pl access'"

# Rule 310105: WEB-CGI view-source directory traversal
SecRule REQUEST_URI "/view-source" \
        "id:310105,rev:1,severity:2,msg:'JITP: view-source directory traversal',chain"
SecRule REQUEST_URI "\.\./"

# Rule 310106: WEB-CGI calendar_admin.pl arbitrary command execution attempt
SecRule REQUEST_URI "/calendar_admin.pl\?config=\|7C\|" \
        "id:310106,rev:1,severity:2,msg:'JITP: calendar_admin.pl arbitrary command execution attempt'"

# Rule 310107: WEB-CGI bb-hist.sh attempt
SecRule REQUEST_URI "/bb-hist\.sh\?HISTFILE=\.\./\.\." \
        "id:310107,rev:1,severity:2,msg:'JITP: bb-hist.sh directory traversal attempt'"

# Rule 310108: WEB-CGI bb-hostscv.sh attempt
SecRule REQUEST_URI "/bb-hostsvc\.sh\?HOSTSVC\?\.\./\.\." \
        "id:310108,rev:1,severity:2,msg:'JITP: bb-hostscv.sh attempt'"

# Rule 310109: WEB-CGI wayboard attempt
SecRule REQUEST_URI "/way-board/way-board\.cgi" \
        "id:310109,rev:1,severity:2,msg:'JITP:  wayboard attempt',chain"
SecRule REQUEST_URI "\.\./\.\."

# Rule 310110: WEB-CGI commerce.cgi arbitrary file access attempt
SecRule REQUEST_URI "/commerce\.cgi" \
        "id:310110,rev:1,severity:2,msg:'JITP: commerce.cgi arbitrary file access attempt',chain"
SecRule REQUEST_URI "/\.\./"

# Rule 310111: WEB-CGI Amaya templates sendtemp.pl directory traversal attempt
SecRule REQUEST_URI "/sendtemp\.pl" \
        "id:310111,rev:1,severity:2,msg:'JITP: Amaya templates sendtemp.pl directory traversal attempt',chain"
SecRule REQUEST_URI "templ="

# Rule 310112: WEB-CGI webspirs.cgi directory traversal attempt
SecRule REQUEST_URI "/webspirs\.cgi" \
        "id:310112,rev:1,severity:2,msg:'JITP: webspirs.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./\.\./"

# Rule 310113: WEB-CGI auktion.cgi directory traversal attempt
SecRule REQUEST_URI "/auktion\.cgi" \
        "id:310113,rev:1,severity:2,msg:'JITP: auktion.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "menue=\.\./\.\./"

# Rule 310114: WEB-CGI cgiforum.pl attempt
SecRule REQUEST_URI "/cgiforum\.pl\?thesection=\.\./\.\." \
        "id:310114,rev:1,severity:2,msg:'JITP: cgiforum.pl attempt'" 

# Rule 310115: WEB-CGI directorypro.cgi attempt
SecRule REQUEST_URI "/directorypro\.cgi" \
        "id:310115,rev:1,severity:2,msg:'JITP: directorypro.cgi attempt',chain" 
SecRule REQUEST_URI "\.\./\.\."

# Rule 310116: WEB-CGI Web Shopper shopper.cgi attempt
SecRule REQUEST_URI "/shopper\.cgi" \
        "id:310116,rev:1,severity:2,msg:'JITP: Web Shopper shopper.cgi attempt',chain"
SecRule REQUEST_URI "newpage=\.\./"

# Rule 310117: WEB-CGI cal_make.pl directory traversal attempt
SecRule REQUEST_URI "/cal_make\.pl" \
        "id:310117,rev:1,severity:2,msg:'JITP: cal_make.pl directory traversal attempt',chain"
SecRule REQUEST_URI "p0=\.\./\.\./"

# Rule 310118: WEB-CGI ttawebtop.cgi arbitrary file attempt
SecRule REQUEST_URI "/ttawebtop\.cgi" \
        "id:310118,rev:1,severity:2,msg:'JITP: ttawebtop.cgi arbitrary file attempt',chain"
SecRule REQUEST_URI "pg=\.\./"

# Rule 310119: WEB-CGI ustorekeeper.pl directory traversal attempt
SecRule REQUEST_URI "/ustorekeeper\.pl" \
        "id:310119,rev:1,severity:2,msg:'JITP: ustorekeeper.pl directory traversal attempt',chain"
SecRule REQUEST_URI "file=\.\./\.\./"

# Rule 310120: WEB-CGI htsearch arbitrary configuration file attempt
SecRule REQUEST_URI "/htsearch\?\-c" \
        "id:310120,rev:1,severity:2,msg:'JITP: WEB-CGI htsearch arbitrary configuration file attempt'"

# Rule 310121: WEB-CGI alibaba.pl arbitrary command execution attempt
SecRule REQUEST_URI "/alibaba\.pl(?:\|7C\||\x7C)" \
        "id:310121,rev:1,severity:2,msg:'JITP: alibaba.pl arbitrary command execution attempt'"

# Rule 310122: WEB-CGI AltaVista Intranet Search directory traversal attempt
SecRule REQUEST_URI "/query\?mss=\.\." \
        "id:310122,rev:1,severity:2,msg:'JITP: AltaVista Intranet Search directory traversal attempt'"

# Rule 310123: WEB-CGI test.bat arbitrary command execution attempt
SecRule REQUEST_URI "/test.bat(?:\|7C\||\x7C)" \
        "id:310123,rev:1,severity:2,msg:'JITP: test.bat arbitrary command execution attempt'"

# Rule 310124: WEB-CGI input.bat arbitrary command execution attempt
SecRule REQUEST_URI "/input.bat(?:\|7C\||\x7C)" \
        "id:310124,rev:1,severity:2,msg:'JITP: input.bat arbitrary command execution attempt'"

# Rule 310125: WEB-CGI envout.bat arbitrary command execution attempt
SecRule REQUEST_URI "/envout.bat(?:\|7C\||\x7C)" \
        "id:310125,rev:1,severity:2,msg:'JITP: envout.bat arbitrary command execution attempt'"

# Rule 310126: WEB-CGI hello.bat arbitrary command execution attempt
SecRule REQUEST_URI "/hello\.bat" \
        "id:310126,rev:1,severity:2,msg:'JITP: hello.bat arbitrary command execution attempt',chain"
SecRule REQUEST_URI "\&"

# Rule 310127: WEB-CGI csSearch.cgi arbitrary command execution attempt
SecRule REQUEST_URI "/csSearch\.cgi" \
        "id:310127,rev:1,severity:2,msg:'JITP: WEB-CGI csSearch.cgi arbitrary command execution attempt',chain"
SecRule REQUEST_URI "\`"

# Rule 310128: WEB-CGI eshop.pl arbitrary command execution attempt
SecRule REQUEST_URI "/eshop\.pl\?seite=(?:\|3B\|\x3B)" \
        "id:310128,rev:1,severity:2,msg:'JITP: WEB-CGI eshop.pl arbitrary command execution attempt'"

# Rule 310129: WEB-CGI loadpage.cgi directory traversal attempt
SecRule REQUEST_URI "/loadpage\.cgi" \
        "id:310129,rev:1,severity:2,msg:'JITP: WEB-CGI loadpage.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "file=\.\./"

# Rule 310130: faqmanager.cgi arbitrary file access attempt
SecRule REQUEST_URI "/faqmanager\.cgi\?toc=*/" \
        "id:310130,rev:1,severity:1,msg:'JITP: faqmanager.cgi arbitrary file attempt',chain"
SecRule REQUEST_URI "/faqmanager\.cgi\?(?:cd|\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(?:download|request|mirror|rget)|id|uname|cvs|svn|(?:s|r)(?:cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"

# Rule 310131: WEB-CGI Home Free search.cgi directory traversal attempt
SecRule REQUEST_URI "/search\.cgi" \
        "id:310131,rev:1,severity:2,msg:'JITP: WEB-CGI Home Free search.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "letter=\.\./\.\."

# Rule 310132: WEB-CGI pfdisplay.cgi arbitrary command execution attempt
SecRule REQUEST_URI "/pfdisplay\.cgi\?'" \
        "id:310132,rev:1,severity:1,msg:'JITP: WEB-CGI pfdisplay.cgi arbitrary command execution attempt'"

# Rule 310133: WEB-CGI pagelog.cgi directory traversal attempt
SecRule REQUEST_URI "/pagelog\.cgi" \
        "id:310133,rev:1,severity:2,msg:'JITP: WEB-CGI pagelog.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "name=\.\./" 

# Rule 310134: WEB-CGI talkback.cgi directory traversal attempt
SecRule REQUEST_URI "/talkbalk\.cgi" \
        "id:310134,rev:1,severity:2,msg:'JITP: WEB-CGI pagelog.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "article=\.\./\.\./"

# Rule 310135: WEB-CGI emumail.cgi NULL attempt
SecRule REQUEST_URI "/emumail\.cgi.*\x00" \
        "id:310135,rev:1,severity:2,msg:'JITP: WEB-CGI emumail.cgi NULL attempt'"

# Rule 310136: WEB-CGI technote main.cgi directory traversal attempt
SecRule REQUEST_URI "/technote/main\.cgi" \
        "id:310136,rev:1,severity:2,msg:'JITP: WEB-CGI technote main.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./\.\./"

# Rule 310137: WEB-CGI technote print.cgi directory traversal attempt
SecRule REQUEST_URI "/technote/print\.cgi.*\x00" \
        "id:310137,rev:1,severity:2,msg:'JITP: WEB-CGI technote print.cgi directory traversal attempt'"

# Rule 310138: WEB-CGI Allaire Pro Web Shell attempt
SecRule REQUEST_URI "/authenticate.cgi\?PASSWORD" \
        "id:310138,rev:1,severity:1,msg:'JITP: WEB-CGI Allaire Pro authenticate.cgi shell attempt',chain"
SecRule REQUEST_URI "config\.ini"

# Rule 310139: WEB-CGI Armada Style Master Index directory traversal
SecRule REQUEST_URI "/search\.cgi\?keys" \
        "id:310139,rev:1,severity:2,msg:'JITP: WEB-CGI Armada Style Master search.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "catigory=\.\./"

# Rule 310140: WEB-CGI cached_feed.cgi moreover shopping cart directory
#	traversal
SecRule REQUEST_URI "/cached_feed\.cgi" \
        "id:310140,rev:1,severity:2,msg:'JITP: WEB-CGI Moreover cached_feed.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./"

# Rule 310141: WEB-CGI Talentsoft Web+ exploit attempt
SecRule REQUEST_URI "/webplus.cgi\?Script=/webplus/webping/webping\.wml" \
        "id:310141,rev:1,severity:2,msg:'JITP: WEB-CGI Talentsoft Web+ exploit attempt'"

# Rule 310142: WEB-CGI bizdbsearch attempt
SecRule REQUEST_URI "/bizdb1-search\.cgi" \
        "id:310142,rev:1,severity:3,msg:'JITP: WEB-CGI Bizdbsearch bizdb1-search.cgi mail attempt',chain"
SecRule REQUEST_URI "mail"

# Rule 310143: WEB-CGI sojourn.cgi File access attempt
SecRule REQUEST_URI "/sojourn\.cgi\?cat=.*\x00" \
        "id:310143,rev:1,severity:2,msg:'JITP: WEB-CGI sojourn.cgi file access attempt'"

# Rule 310144: WEB-CGI SGI InfoSearch fname attempt
SecRule REQUEST_URI "/infosrch\.cgi\?" \
        "id:310144,rev:1,severity:2,msg:'JITP: WEB-CGI infosrch.cgi fname attempt',chain"
SecRule REQUEST_URI "fname="

# Rule 310145: WEB-CGI store.cgi directory traversal attempt
SecRule REQUEST_URI "/store\.cgi" \
        "id:310145,rev:1,severity:2,msg:'JITP: WEB-CGI store.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "\.\./"

# Rule 310146: WEB-CGI SIX webboard generate.cgi file access attempt
SecRule REQUEST_URI "/generate\.cgi" \
        "id:310146,rev:1,severity:1,msg:'JITP: WEB-CGI generate.cgi file access attempt',chain"
SecRule REQUEST_URI "content=\.\./"

# Rule 310147: WEB-CGI story.pl arbitrary file read attempt
SecRule REQUEST_URI "/story\.pl" \
        "id:310147,rev:1,severity:1,msg:'JITP: WEB-CGI story.pl file access attempt',chain"
SecRule REQUEST_URI "next=\.\./"

# Rule 310148: WEB-CGI mrtg.cgi directory traversal attempt
SecRule REQUEST_URI "/mrtg\.cgi" \
        "id:310148,rev:1,severity:2,msg:'JITP: WEB-CGI mrtg.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "cfg=/\.\./"

# Rule 310149:alienform.cgi directory traversal attempt
SecRule REQUEST_URI "/alienform\.cgi.*\.\|7C\|\./\.\|7C\|\." \
        "id:310149,rev:1,severity:2,msg:'JITP: WEB-CGI alienform.cgi directory traversal attempt',chain"
SecRule REQUEST_URI "/af\.cgi.*\.\|7C\|\./\.\|7C\|\."

# Rule 310150: WEB-CGI CCBill whereami.cgi arbitrary command execution attempt
SecRule REQUEST_URI "/whereami\.cgi\?g=" \
        "id:310150,rev:1,severity:1,msg:'JITP: WEB-CGI CCbill whereami.cgi command execution attempt'"

# Rule 310151: WEB-CGI MDaemon form2raw.cgi overflow attempt
SecRule REQUEST_URI "/form2raw\.cgi" \
        "id:310151,rev:1,severity:1,msg:'JITP: WEB-CGI MDaemon form2raw.cgi overflow attempt'"

# Rule 310152: WEB-CGI WhatsUpGold instancename overflow attempt
SecRule REQUEST_URI "/_maincfgret\.cgi" \
        "id:310152,rev:1,severity:1,msg:'JITP: WEB-CGI WhatsUpGold _maincfgret.cgi overflow attempt'"

# Rule 310153: Honeypot signature.
SecRule REQUEST_URI|REQUEST_BODY "clamav-partial " \
        "id:310153,rev:1,severity:2,msg:'JITP: WEB-CGI clamav-patial recovery file access attempt',chain"
SecRule REQUEST_URI|REQUEST_BODY "vi\.recover "

# Rule 310154: WEB-COLDFUSION cfcache.map access
SecRule REQUEST_URI "/cfcache\.map" \
        "id:310154,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion cfcache.map file access attempt'"

# Rule 310155: WEB-COLDFUSION exampleapp application.cfm
SecRule REQUEST_URI "/cfdocs/exampleapp/email/application\.cfm" \
        "id:310155,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion exampleapp e-mail application.cfm access attempt'"

# Rule 310156: WEB-COLDFUSION application.cfm access
SecRule REQUEST_URI "/cfdocs/exampleapp/publish/admin/application\.cfm" \
        "id:310156,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion exampleapp publisher application.cfm access attempt'"

# Rule 310157: WEB-COLDFUSION getfile.cfm access
SecRule REQUEST_URI "/cfdocs/exampleapp/email/getfile\.cfm" \
        "id:310157,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion exampleapp e-mail getfile.cfm access attempt'"

# Rule 310158: WEB-COLDFUSION addcontent.cfm access
SecRule REQUEST_URI "/cfdocs/exampleapp/publish/admin/addcontent\.cfm" \
        "id:310158,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion exampleapp addcontent.cfm access attempt'"

# Rule 310159: WEB-COLDFUSION administrator access
SecRule REQUEST_URI "/cfide/administrator/index\.cfm" \
        "id:310159,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion administrator access attempt'"

# Rule 310160: WEB-COLDFUSION fileexists.cfm access
SecRule REQUEST_URI "/cfdocs/snippets/fileexists\.cfm" \
        "id:310160,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion fileexists.cfm access attempt'"

# Rule 310161: WEB-COLDFUSION exprcalc access
SecRule REQUEST_URI "/cfdocs/expeval/exprcalc\.cfm" \
        "id:310161,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion expercalc.cfm access attempt'"

# Rule 310162: WEB-COLDFUSION parks access
SecRule REQUEST_URI "/cfdocs/examples/parks/detail\.cfm" \
        "id:310162,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion parks detail.cfm access attempt'"

# Rule 310163: WEB-COLDFUSION cfappman access
SecRule REQUEST_URI "/cfappman/index\.cfm" \
        "id:310163,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion cfappman index.cfm access attempt'"

# Rule 310164: WEB-COLDFUSION beaninfo access
SecRule REQUEST_URI "/cfdocs/examples/cvbeans/beaninfo\.cfm" \
        "id:310164,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion beaninfo.cfm access attempt'"

# Rule 310165: WEB-COLDFUSION evaluate.cfm access
SecRule REQUEST_URI "/cfdocs/snippets/evaluate\.cfm" \
        "id:310165,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion evaluate.cfm access attempt'"

# Rule 310166: WEB-COLDFUSION expeval access
SecRule REQUEST_URI "/cfdocs/expeval/" \
        "id:310166,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion expeval access attempt'"

# Rule 310167: WEB-COLDFUSION displayfile access
SecRule REQUEST_URI "/cfdocs/expeval/displayopenedfile\.cfm" \
        "id:310167,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion displayfile access attempt'"

# Rule 310168: WEB-COLDFUSION mainframeset access
SecRule REQUEST_URI "/cfdocs/examples/mainframeset\.cfm" \
        "id:310168,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion mainframeset.cfm access attempt'"

# Rule 310169: WEB-COLDFUSION exampleapp access
SecRule REQUEST_URI "/cfdocs/exampleapp/" \
        "id:310169,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion exampleapp access attempt'"

# Rule 310170: WEB-COLDFUSION snippets attempt
SecRule REQUEST_URI "/cfdocs/snippets/" \
        "id:310170,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion snippers access attempt'"

# Rule 310171: WEB-COLDFUSION cfmlsyntaxcheck.cfm access
SecRule REQUEST_URI "/cfdocs/cfmlsyntaxcheck\.cfm" \
        "id:310171,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion cfmlsyntaxcheck.cfm access attempt'"

# Rule 310172: WEB-COLDFUSION application.cfm access
SecRule REQUEST_URI "/application\.cfm" \
        "id:310172,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion application.cfm direct access attempt'"

# Rule 310173: WEB-COLDFUSION onrequestend.cfm access
SecRule REQUEST_URI "/onrequestend\.cfm" \
        "id:310173,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion onrequestend.cfm direct access attempt'"

# Rule 310174: WEB-COLDFUSION startstop.cfm DoS access attempt
SecRule REQUEST_URI "/cfide/administrator/startstop\.html" \
        "id:310174,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion startstop.cfm DoS attempt'"

# Rule 310175: WEB-COLDFUSION gettempdirectory.cfm access 
SecRule REQUEST_URI "/cfdocs/snippets/gettempdirectory\.cfm" \
        "id:310175,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion gettempdirectory.cfm direct access attempt'"

# Rule 310176: WEB-COLDFUSION sendmail.cfm access
SecRule REQUEST_URI "/sendmail\.cfm" \
        "id:310176,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion sendmail.cfm direct access attempt'"

# Rule 310177: WEB-COLDFUSION ?Mode=debug attempt
#SecRule REQUEST_URI "Mode=debug" \
        "id:310177,rev:1,severity:2,msg:'JITP: WEB-COLDFUSION Coldfusion debug mode access attempt'"

# Rule 310178: WEB-MISC Tomcat view source attempt
SecRule REQUEST_URI|REQUEST_BODY "\x252ejsp" \
        "id:310178,rev:1,severity:2,msg:'JITP: WEB-MISC Tomcat .jsp source display attempt'"

# Rule 310179: WEB-MISC Unify eWave ServletExec upload
SecRule REQUEST_URI|REQUEST_BODY "/servlet/com\.unify\.servletexec\.UploadServlet" \
        "id:310179,rev:1,severity:2,msg:'JITP: WEB-MISC Unify eWave UploadServlet abuse attempt'"

# Rule 310180: WEB-MISC Talentsoft Web+ Source Code view access
SecRule REQUEST_URI "/webplus\.exe\?script=test\.wml" \
        "id:310180,rev:1,severity:2,msg:'JITP: WEB-MISC Talentsoft Web+ source code access attempt'"

# Rule 310181: WEB-MISC ftp.pl attempt
SecRule REQUEST_URI "/ftp\.pl\?dir=\.\./\.\." \
        "id:310181,rev:1,severity:2,msg:'JITP: WEB-MISC Talentsoft Web+ source code access attempt'"

# Rule 310182: WEB-MISC apache source.asp file access
SecRule REQUEST_URI "/site/eg/source\.asp" \
        "id:310182,rev:1,severity:2,msg:'JITP: WEB-MISC Apache source.asp source code access attempt'"

# Rule 310183: WEB-MISC Tomcat server exploit access
SecRule REQUEST_URI "/contextAdmin/contextAdmin\.html" \
        "id:310183,rev:1,severity:2,msg:'JITP: WEB-MISC tomcat contextAdmin exploit attempt'"

# Rule 310184: WEB-MISC Ecommerce import.txt access
SecRule REQUEST_URI "/orders/import\.txt" \
        "id:310184,rev:1,severity:2,msg:'JITP: WEB-MISC eCommerce import.txt access attempt'"

# Rule 310185: WEB-MISC Domino catalog.nsf access
SecRule REQUEST_URI "/catalog\.nsf" \
        "id:310185,rev:1,severity:2,msg:'JITP: WEB-MISC Domino catalog.nsf access attempt'"

# Rule 310186: WEB-MISC Domino domcfg.nsf access
SecRule REQUEST_URI "/domcfg\.nsf" \
        "id:310186,rev:1,severity:2,msg:'JITP: WEB-MISC Domino domcfg.nsf access attempt'"

# Rule 310187: WEB-MISC Domino domlog.nsf access
SecRule REQUEST_URI "/domlog\.nsf" \
        "id:310187,rev:1,severity:2,msg:'JITP: WEB-MISC Domino domlog.nsf access attempt'"

# Rule 310188: WEB-MISC Domino log.nsf access
SecRule REQUEST_URI "/log\.nsf" \
        "id:310188,rev:1,severity:2,msg:'JITP: WEB-MISC Domino log.nsf access attempt'"

# Rule 310189: WEB-MISC Domino names.nsf access
SecRule REQUEST_URI "/names\.nsf" \
        "id:310189,rev:1,severity:2,msg:'JITP: WEB-MISC Domino names.nsf access attempt'"

# Rule 310190: WEB-MISC Domino mab.nsf access
SecRule REQUEST_URI "/mab\.nsf" \
        "id:310190,rev:1,severity:2,msg:'JITP: WEB-MISC Domino mab.nsf access attempt'"

# Rule 310191: WEB-MISC Domino cersvr.nsf access
SecRule REQUEST_URI "/cersvr\.nsf" \
        "id:310191,rev:1,severity:2,msg:'JITP: WEB-MISC Domino cersvr.nsf access attempt'"

# Rule 310192: WEB-MISC Domino setup.nsf access
SecRule REQUEST_URI "/setup\.nsf" \
        "id:310192,rev:1,severity:2,msg:'JITP: WEB-MISC Domino setup.nsf access attempt'"

# Rule 310193: WEB-MISC Domino statrep.nsf access
SecRule REQUEST_URI "/statrep\.nsf" \
        "id:310193,rev:1,severity:2,msg:'JITP: WEB-MISC Domino statrep.nsf access attempt'"

# Rule 310194: WEB-MISC Domino webadmin.nsf access
SecRule REQUEST_URI "/webadmin\.nsf" \
        "id:310194,rev:1,severity:2,msg:'JITP: WEB-MISC Domino webadmin.nsf access attempt'"

# Rule 310195: WEB-MISC Domino events4.nsf access
SecRule REQUEST_URI "/events4\.nsf" \
        "id:310195,rev:1,severity:2,msg:'JITP: WEB-MISC Domino events4.nsf access attempt'"

# Rule 310196: WEB-MISC Domino ntsync4.nsf access
SecRule REQUEST_URI "/ntsync4\.nsf" \
        "id:310196,rev:1,severity:2,msg:'JITP: WEB-MISC Domino ntsync4.nsf access attempt'"

# Rule 310197: WEB-MISC Domino collect4.nsf access
SecRule REQUEST_URI "/collect4\.nsf" \
        "id:310197,rev:1,severity:2,msg:'JITP: WEB-MISC Domino collect4.nsf access attempt'"

# Rule 310198: WEB-MISC Domino mailw46.nsf access
SecRule REQUEST_URI "/mailw46\.nsf" \
        "id:310198,rev:1,severity:2,msg:'JITP: WEB-MISC Domino mailw46.nsf access attempt'"

# Rule 310199: WEB-MISC Domino bookmark.nsf access
SecRule REQUEST_URI "/bookmark\.nsf" \
        "id:310199,rev:1,severity:2,msg:'JITP: WEB-MISC Domino bookmark.nsf access attempt'"

# Rule 310200: WEB-MISC Domino agentrunner.nsf access
SecRule REQUEST_URI "/agentrunner\.nsf" \
        "id:310200,rev:1,severity:2,msg:'JITP: WEB-MISC Domino agentrunner.nsf access attempt'"

# Rule 310201: WEB-MISC Domino mail.box access
#SecRule REQUEST_URI "/mail.box" \
        "id:310201,rev:1,severity:2,msg:'JITP: WEB-MISC Domino mail.box access attempt'"

# Rule 310202: WEB-MISC Ecommerce checks.txt access
SecRule REQUEST_URI "/orders/checks\.txt" \
        "id:310202,rev:1,severity:2,msg:'JITP: WEB-MISC Ecommerce checks.txt access attempt'"

# Rule 310203: WEB-MISC mall log order access
SecRule REQUEST_URI "/mall_log_files/order\.log" \
        "id:310203,rev:1,severity:2,msg:'JITP: WEB-MISC Mall Log order access attempt'"

# Rule 310204: WEB-MISC ROADS search.pl attempt
SecRule REQUEST_URI "/ROADS/cgi-bin/search\.pl" \
        "id:310204,rev:1,severity:2,msg:'JITP: WEB-MISC ROADS search.pl access attempt',chain"
SecRule REQUEST_URI "form="

# Rule 310205: WEB-MISC SWEditServlet directory traversal attempt
SecRule REQUEST_URI "/SWEditServlet" \
        "id:310205,rev:1,severity:2,msg:'JITP: WEB-MISC SWEditServlet directory traversal attempt',chain"
SecRule REQUEST_URI "template=\.\./\.\./\.\./"

# Rule 310206: WEB-MISC RBS ISP /newuser directory traversal attempt
SecRule REQUEST_URI "/newuser\?Image=\.\./\.\." \
        "id:310206,rev:1,severity:2,msg:'JITP: WEB-MISC RBS ISP /newuser directory traversal attempt'"

# Rule 310207: WEB-MISC PCCS mysql database admin tool access
SecRule REQUEST_URI "pccsmysqladm/incs/dbconnect\.inc" \
        "id:310207,rev:1,severity:2,msg:'JITP: WEB-MISC PCCS MySQL database admin tool access attempt'"

# Rule 310208: WEB-MISC ans.pl attempt
SecRule REQUEST_URI "/ans.pl\?p=\.\./\.\./" \
        "id:310208,rev:1,severity:1,msg:'JITP: WEB-MISC ans.pl file access attempt'"

# Rule 310209: WEB-MISC Demarc SQL injection attempt
SecRule REQUEST_URI "/dm/demarc" \
        "id:310209,rev:1,severity:2,msg:'JITP: WEB-MISC Demarc SQL injection attempt',chain"
SecRule REQUEST_URI "\'" 

# Rule 310210: WEB-MISC philboard_admin.asp authentication bypass attempt
SecRule REQUEST_URI  "/philboard_admin\.asp" \
        "id:310210,rev:1,severity:2,msg:'JITP: WEB-MISC philboard_admin.asp authentication bypass attempt',chain"
SecRule REQUEST_URI "philboard_admin=True" 

# Rule 310211: WEB-PHP Phorum /support/common.php access
SecRule REQUEST_URI  "/support/common\.php" \
        "id:310211,rev:1,severity:2,msg:'JITP: WEB-PHP Phorum common.php direct access attempt'"

# Rule 310212: WEB-PHP rolis guestbook remote file include attempt
SecRule REQUEST_URI  "/insert\.inc\.php" \
        "id:310212,rev:1,severity:2,msg:'JITP: WEB-PHP Rolis guestbook insert.inc.php remote file inclusion attempt',chain"
SecRule REQUEST_URI "path="

# Rule 310213: book.cgi arbitrary command execution attempt
SecRule REQUEST_URI  "/book\.cgi.*current=\|7C\|" \
        "id:310213,rev:1,severity:1,msg:'JITP: book.cgi arbitrary command execution attempt'"

# Rule 310214: WEB-PHP gallery remote file include attempt
SecRule REQUEST_URI  "/setup/" \
        "id:310214,rev:1,severity:2,msg:'JITP: WEB-PHP Gallery /setup remote file inclusion attempt',chain"
SecRule REQUEST_URI "GALLERY_BASEDIR=(?:http|https|ftp)\:/"

# Rule 310215:Needinit remote file include attempt
SecRule REQUEST_URI  "/needinit\.php\?" \
        "id:310215,rev:1,severity:2,msg:'JITP: Needinit needinit.php remote file inclusion attempt',chain"
SecRule REQUEST_URI "GALLERY_BASEDIR=(?:http|https|ftp)\:/"

# Rule 310216: WEB-PHP IdeaBox cord.php file include
SecRule REQUEST_URI  "/index\.php" \
        "id:310216,rev:1,severity:2,msg:'JITP: WEB-PHP: IdeaBox cord.php file inclusion attempt',chain"
SecRule REQUEST_URI "cord\.php" 

# Rule 310217: WEB-PHP Invision Board ipchat.php file include
SecRule REQUEST_URI  "/ipchat\.php" \
        "id:310217,rev:1,severity:2,msg:'JITP: WEB-PHP: Invision Board ipchat.php file inclusion attempt',chain"
SecRule REQUEST_URI "conf_global\.php"

# Rule 310218: WEB-PHP myphpPagetool pt_config.inc file include
SecRule REQUEST_URI  "/doc/admin" \
        "id:310218,rev:1,severity:2,msg:'JITP: WEB-PHP: myphpPagetool pt_config.inc file inclusion attempt',chain"
SecRule REQUEST_URI "pt_config\.inc"

# Rule 310219: WEB-PHP YaBB SE packages.php file include
SecRule REQUEST_URI  "/packages\.php" \
        "id:310219,rev:1,severity:2,msg:'JITP: WEB-PHP: YaBB SE packages.php file inclusion attempt',chain"
SecRule REQUEST_URI "packer\.php"

# Rule 310220: WEB-PHP PhpGedView PGV authentication_index.php base directory
#	manipulation attempt
SecRule REQUEST_URI  "/authentication_index\.php" \
        "id:310220,rev:1,severity:2,msg:'JITP: WEB-PHP: PhpGedView PGV authentication_index.php base directory manipulation attempt',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY"

# Rule 310221: WEB-PHP PhpGedView PGV functions.php base directory manipulation
#	attempt
SecRule REQUEST_URI  "/functions\.php" \
        "id:310221,rev:1,severity:2,msg:'JITP: WEB-PHP: PhpGedView PGV functions.php base directory manipulation attempt',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY"

# Rule 310222: WEB-PHP PhpGedView PGV config_gedcom.php base directory
#	manipulation attempt
SecRule REQUEST_URI  "/config_gedcom\.php" \
        "id:310222,rev:1,severity:2,msg:'JITP: WEB-PHP: PhpGedView PGV config_gedcom.php base directory manipulation attempt',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY"

# Rule 310223: WEB-PHP PhpGedView PGV base directory manipulation
SecRule REQUEST_URI  "_conf\.php" \
        "id:310223,rev:1,severity:2,msg:'JITP: WEB-PHP: PhpGedView PGV _conf.php base directory manipulation attempt',chain"
SecRule REQUEST_URI "PGV_BASE_DIRECTORY"

# Rule 310224: WEB-PHP WAnewsletter newsletter.php file inclusion attempt
SecRule REQUEST_URI  "newsletter\.php" \
        "id:310224,rev:1,severity:2,msg:'JITP: WEB-PHP: WAnewsletter newsletter.php file inclusion attempt',chain"
SecRule REQUEST_URI "start\.php"

# Rule 310225: WEB-PHP Opt-X header.php remote file include attempt
SecRule REQUEST_URI  "/header\.php" \
        "id:310225,rev:1,severity:2,msg:'JITP: WEB-PHP: Opt-X header.php remote file inclusion attempt',chain"
SecRule REQUEST_URI "systempath="

# Rule 310226:webdav search attack
SecRule REQUEST_URI  "/_vti_bin/_vti_aut/fp30reg\.dll" \
        "id:310226,rev:1,severity:2,msg:'JITP: webdav fp30reg.dll search exploit attempt'"

# Rule 310227:/auth.php?path=http://[attacker]/
SecRule REQUEST_URI  "/auth.php\?path=(?:http|https|ftp)\:/" \
        "id:310227,rev:1,severity:2,msg:'JITP: auth.php remote file inclusion attempt'"

# Rule 310228: Dforum executable code injection attempt
SecRule REQUEST_URI  "/dforum/nav\.php3\?page=<[[:space:]]*(?:script|about|applet|activex|chrome)+.*(?:script|about|applet|activex|chrome)[[:space:]]*>" \
        "id:310228,rev:1,severity:2,msg:'JITP: Dforum nav.php3 executable code injection attempt'"

# Rule 310229: phpMyAdmin path vln
SecRule REQUEST_URI "/phpMyAdmin/css/phpmyadmin\.css\.php\?GLOBALS\[cfg\]\[ThemePath\]=(?:/|.*\.\./)" \
        "id:310229,rev:1,severity:2,msg:'JITP: phpMyAdmin phpmyadmin.css.php file inclusion attempt'"

# Rule 310230: PHPBB full path disclosure
SecRule REQUEST_URI "phpBB/db/oracle\.php" \
        "id:310230,rev:1,severity:2,msg:'JITP: PHPBB oracle.php full path disclosure attempt'"

# Rule 310231: PHPBB full path disclosure
SecRule REQUEST_URI "forum/db/oracle\.php" \
        "id:310231,rev:1,severity:2,msg:'JITP: PHPBB oracle.php full path disclosure attempt'"

# Rule 310232: PHPBB full path disclosure
SecRule REQUEST_URI "forums/db/oracle\.php" \
        "id:310232,rev:1,severity:2,msg:'JITP: PHPBB oracle.php full path disclosure attempt'"

# Rule 310233: PHP Form Mail Script File Incusion vuln
SecRule REQUEST_URI "/inc/formmail\.inc\.php\?script_root=(?:http|https|ftp)\:/" \
        "id:310233,rev:1,severity:2,msg:'JITP: PHP formmail.inc.php file inclusion attempt'"

# Rule 310234: Download Center Lite command execution vuln
SecRule REQUEST_URI "/inc/download_center_lite\.inc\.php\?script_root=(?:http|https|ftp)\:/" \
        "id:310234,rev:1,severity:1,msg:'JITP: Download Center Lite download_center_lite.inc.php command execution attempt'"

# Rule 310235: /modules/mod_mainmenu.php?mosConfig_absolute_path=http://
SecRule REQUEST_URI "/modules/mod_mainmenu\.php\?mosConfig_absolute_path=(?:http|https|ftp)\:/" \
        "id:310235,rev:1,severity:1,msg:'JITP: mod_mainmenu.php command execution attempt'"

# Rule 310236: phpWebLog command execution
SecRule REQUEST_URI "/init\.inc\.php\?G_PATH=(?:http|https|ftp)\:/" \
        "id:310236,rev:1,severity:1,msg:'JITP: phpWebLog init.inc.php command execution attempt'"

# Rule 310237: phpWebLog command execution
SecRule REQUEST_URI "/backend/addons/links/index\.php\?PATH=(?:http|https|ftp)\:/" \
        "id:310237,rev:1,severity:1,msg:'JITP: phpWebLog backend index.php command execution attempt'"

# Rule 310238: mcNews command execution
SecRule REQUEST_URI "/mcNews/admin/header\.php\?skinfile=(?:http|https|ftp)\:/" \
        "id:310238,rev:1,severity:1,msg:'JITP: mcNews header.php command execution attempt'"

# Rule 310239: phpbb
SecRule REQUEST_URI "admin/admin_styles\.php\?mode=addnew\&install_to=\.\./\.\./" \
        "id:310239,rev:1,severity:2,msg:'JITP: phpBB admin_styles.php directory traversal attempt'"

# Rule 310240: votebox
SecRule REQUEST_URI "/votebox\.php\?VoteBoxPath=(?:http|https|ftp)\:/" \
        "id:310240,rev:1,severity:1,msg:'JITP: votebox.php command execution attempt'"

# Rule 310241: phpAdsNew path disclosure
SecRule REQUEST_URI "/libraries/lib-xmlrpcs.inc\.php" \
        "id:310241,rev:1,severity:2,msg:'JITP: phpAdsNew lib-xmlrpcs.inc.php path disclosure attempt'"

# Rule 310242: phpAdsNew path disclosure
SecRule REQUEST_URI "/maintenance/maintenance-activation\.php" \
        "id:310242,rev:1,severity:2,msg:'JITP: phpAdsNew maintenance-activation.php path disclosure attempt'"

# Rule 310243: phpAdsNew path disclosure
SecRule REQUEST_URI "/maintenance/maintenance-cleantables\.php" \
        "id:310243,rev:1,severity:2,msg:'JITP: phpAdsNew maintenance-cleantables.php path disclosure attempt'"

# Rule 310244: phpAdsNew path disclosure
SecRule REQUEST_URI "/maintenance/maintenance-autotargeting\.php" \
        "id:310244,rev:1,severity:2,msg:'JITP: phpAdsNew maintenance-autotargeting.php path disclosure attempt'"

# Rule 310245: phpAdsNew path disclosure
SecRule REQUEST_URI "/maintenance/maintenance-reports\.php" \
        "id:310245,rev:1,severity:2,msg:'JITP: phpAdsNew maintenance-reports.php path disclosure attempt'"

# Rule 310246: phpAdsNew path disclosure
SecRule REQUEST_URI "/misc/backwards\x20compatibility/phpads\.php" \
        "id:310246,rev:1,severity:2,msg:'JITP: phpAdsNew backwards compatibility phpads.php path disclosure attempt'"

# Rule 310247: phpAdsNew path disclosure
SecRule REQUEST_URI "/misc/backwards\x20compatibility/remotehtmlview\.php" \
        "id:310247,rev:1,severity:2,msg:'JITP: phpAdsNew backwards compatibility remotehtmlview.php path disclosure attempt'"

# Rule 310248: phpAdsNew path disclosure
SecRule REQUEST_URI "/misc/backwards\x20compatibility/click\.php" \
        "id:310248,rev:1,severity:2,msg:'JITP: phpAdsNew backwards compatibility click.php path disclosure attempt'"

# Rule 310249: phpAdsNew path disclosure
SecRule REQUEST_URI "/adframe\.php\?refresh=securityreason\.com\'\>" \
        "id:310249,rev:1,severity:2,msg:'JITP: phpAdsNew adframe.php path disclosure attempt'"

# Rule 310250: include cgi command exec
SecRule REQUEST_URI "/includer\.cgi\?=\|" \
        "id:310250,rev:1,severity:1,msg:'JITP: includer.cgi command execution attempt'"

# Rule 310251: citrusDB directory traversal
#adjust these to your system, you might need to upload
SecRule REQUEST_URI "tools/index\.php\?load=\.\./\.\./" \
        "id:310251,rev:1,severity:2,msg:'JITP: citrusDB tools/index.php directory traversal attempt'"

# Rule 310252: citrusDB upload authorization bypass (CAN-2005-0409)
SecRule REQUEST_URI "citrusdb/tools/index\.php\?load=importcc\&submit=on" \
        "id:310252,rev:1,severity:1,msg:'JITP: citrusDB tools/index.php upload authorization bypass attempt'"

# Rule 310253: citrusDB
SecRule REQUEST_URI "/citrusdb/tools/uploadcc\.php" \
        "id:310253,rev:1,severity:1,msg:'JITP: citrusDB tools/uploadcc.php credit card data upload attempt'"

# Rule 310254: awstats - local command execution
SecRule REQUEST_URI  "/awstats\.pl\?(?:configdir|update|pluginmode|cgi)=(?:\||echo|\:system\()" \
        "id:310254,rev:1,severity:1,msg:'JITP: awstats.pl command execution attempt'"

# Rule 310255: awstats - local file alteration
SecRule REQUEST_URI  "/awstats\.pl\?(?:debug=1|pluginmode=rawlog\&loadplugin=rawlog|update=1\&logfile=\|)" \
        "id:310255,rev:1,severity:1,msg:'JITP: awstats.pl local file access attempt'"

# Rule 310256: awstats vulns
SecRule REQUEST_URI  "/awstats\.pl\?[^\r\n]*logfile=\|" \
        "id:310256,rev:1,severity:1,msg:'JITP: awstats.pl local file access attempt'"

# Rule 310257: awstats vulns
SecRule REQUEST_URI  "/awstats\.pl\?configdir=" \
        "id:310257,rev:1,severity:2,msg:'JITP: awstats.pl directory traversal attempt'"

# Rule 310259: awstats vulns
SecRule REQUEST_URI  "awstats\.pl\?" \
        "chain,id:310259,rev:2,severity:2,msg:'JITP: awstats local file system access monkey business attempt'"
SecRule ARGS "(?:debug|configdir|perl|chmod|exec|print|cgi)" \

# Rule 310260: yabb
SecRule REQUEST_URI "/YaBB\.pl\?action=usersrecentposts\;username=\<IFRAME.*javascript\:alert\(\'" \
        "id:310260,rev:1,severity:2,msg:'JITP: YaBB.pl Javascript injection attempt'"

#  Rule 310261: WEB-FRONTPAGE .... request
SecRule REQUEST_URI|REQUEST_BODY "\.\.\.\./" \
        "id:310261,rev:1,severity:2,msg:'JITP: WEB-FRONTPAGE directory traversal attempt'"

# Rule 310262: phpbb XSS
SecRule REQUEST_URI "/posting\.php\?mode=reply&t=.*userid.*phpbb2mysql_t=(?:\<(?:script|javascript|about|applet|activex|chrome)|(?:http|https|ftp)\:/)" \
        "id:310262,rev:1,severity:2,msg:'JITP: phpBB posting.php cross-site-scripting attempt'"

# Rule 310263: phpbb XSS
SecRule REQUEST_URI "/posting\.php\\?.*(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310263,rev:1,severity:2,msg:'JITP: phpBB posting.php cross-site-scripting attempt'"

# Rule 310264: phpbb XSS
SecRule REQUEST_URI|REQUEST_BODY "/privmsg\.php" \
        "id:310264,rev:1,severity:2,msg:'JITP: phpBB privmsg.php cross-site-scripting attempt',chain"
SecRule REQUEST_URI|REQUEST_BODY "\<a href=*(?:script|about|applet|activex|chrome)"

# Rule 310265: proxy grabber
SecRule REQUEST_URI  "/proxy-grabber\.com/cgi-bin/v2/nph-env\.cgi\?" \
        "id:310265,rev:1,severity:2,msg:'JITP: Proxy Grabber nph-env.cgi access attempt'"

# Rule 310266: Unique stuff caught in our traps
SecRule REQUEST_URI  "/mail_autocheck\.php\?pm_path=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310266,rev:1,severity:2,msg:'JITP: mail_autocheck.php cross-site-scripting attempt'"

# Rule 310267:  Remote File Inclusion Vulnerability in phpWebLog
SecRule REQUEST_URI  "/include/init\.inc\.php\?G_PATH=(?:http|https|ftp)\:/" \
        "id:310267,rev:1,severity:2,msg:'JITP: phpWebLog init.inc.php remote file inclusion attempt'"

# Rule 310268:  Remote File Inclusion Vulnerability in phpWebLog
SecRule REQUEST_URI  "addons/links/index\.php\?PATH=(?:http|https|ftp)\:/" \
        "id:310268,rev:1,severity:2,msg:'JITP: phpWebLog links/index.php remote file inclusion attempt'"

# Rule 310269: Multiple Vulnerabilities in ProjectBB
SecRule REQUEST_URI  "/divers\.php\?action=liste\&liste=\&desc=\&pages=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310269,rev:1,severity:2,msg:'JITP: ProjectBB divers.php cross-site-scripting attempt'"

# Rule 310270: Multiple Vulnerabilities in ProjectBB
SecRule REQUEST_URI "/divers\.php\?action=liste\&liste=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310270,rev:1,severity:2,msg:'JITP: ProjectBB divers.php cross-site-scripting attempt'"

# Rule 310271: Multiple Vulnerabilities in ProjectBB
SecRule REQUEST_URI "/Zip/divers\.php\?action =liste&liste=email&desc=.*\'" \
        "id:310271,rev:1,severity:2,msg:'JITP: ProjectBB Zip/divers.php SQL injection attempt'"

# Rule 310272: WebChat english.php or db_mysql.php file include
SecRule REQUEST_URI "/defines\.php*WEBCHATPATH*(?:db_mysql\.php|english\.php)" \
        "id:310272,rev:1,severity:2,msg:'JITP: WebChat defines.php local file inclusion attempt'"

# Rule 310273: Cross-Site Scripting Vulnerability in D-Forum
SecRule REQUEST_URI "/nav\.php3\?page=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310273,rev:1,severity:2,msg:'JITP: D-Forum nav.php3 cross-site-scripting attempt'"

# Rule 310274: Multiple Vulnerabilities in auraCMS
SecRule REQUEST_URI "/index\.php\?query=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/).*\&pilih=search" \
        "id:310274,rev:1,severity:2,msg:'JITP: auraCMA index.php cross-site-scripting attempt'"

# Rule 310275: Multiple Vulnerabilities in auraCMS
SecRule REQUEST_URI "/hits\.php\?hits=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310275,rev:1,severity:2,msg:'JITP: auraCMA hits.php cross-site-scripting attempt'"

# Rule 310276: Multiple Vulnerabilities in auraCMS
SecRule REQUEST_URI "/counter\.php\?theCount=(?:\<(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310276,rev:1,severity:2,msg:'JITP: auraCMA counter.php cross-site-scripting attempt'"

# Rule 310277: vBulletin Remote Command Execution Attempt
SecRule REQUEST_URI "/forumdisplay\.php?[^\r\n]*comma=[^\r\n\x26]*system\x28.*\x29/Ui" \
        "id:310277,rev:1,severity:1,msg:'JITP: vBulletin forumdisplay.php local command execution attempt'"

# Rule 310278: vBulletin Remote Command Execution Attempt
SecRule REQUEST_URI "/forumdisplay\.php\?" \
        "id:310278,rev:1,severity:1,msg:'JITP: vBulletin forumdisplay.php local command execution attempt',chain"
SecRule REQUEST_URI|REQUEST_BODY "\.system\(.+\)\."

# Rule 310279: vBulletin Remote Command Execution Attempt
SecRule REQUEST_URI "/forumdisplay\.php\?*comma=" \
        "id:310279,rev:1,severity:1,msg:'JITP: vBulletin forumdisplay.php local command execution attempt'"

# Rule 310280:  PHPNuke general XSS attempt
#/modules.php?name=News&file=article&sid=1&optionbox=
SecRule REQUEST_URI "/modules\.php\?*name=*\<*(?:script|about|applet|activex|chrome)*\>" \
        "id:310280,rev:1,severity:2,msg:'JITP: PHPnuke modules.php cross-site-scripting attempt'"

# Rule 310281:  PHPNuke general XSS attempt
SecRule REQUEST_URI "/modules\.php\?op=modload&name=News&file=article&sid=*\<*(?:script|about|applet|activex|chrome)*\>" \
        "id:310281,rev:1,severity:2,msg:'JITP: PHPnuke modules.php cross-site-scripting attempt'"

# Rule 310282:  PHPNuke SQL injection attempt
SecRule REQUEST_URI  "/modules\.php\?*name=Search*instory=" \
        "id:310282,rev:1,severity:2,msg:'JITP: PHPnuke modules.php SQL injection attempt'"

# Rule 310283:  PHPNuke SQL injection attempt
SecRule REQUEST_URI  "/modules\.php\?*name=(?:Search|Web_Links).*\'" \
        "id:310283,rev:1,severity:2,msg:'JITP: PHPnuke modules.php SQL injection attempt'"

# Rule 310284:  EasyDynamicPages exploit
SecRule REQUEST_URI|REQUEST_BODY "edp_relative_path=" \
        "id:310284,rev:1,severity:2,msg:'JITP: EasyDynamicPages edp_relative_path exploitation attempt'"

# Rule 310285:  Readfile.tcl Access
SecRule REQUEST_URI "/readfile\.tcl\?file=" \
        "id:310285,rev:1,severity:1,msg:'JITP: readfile.tcl local file access attempt'"

# Rule 310286:  phpnuke sql insertion
# When will people learn that running *nuke is one step shy of posting the
# admin passwords to their sites on the frontpage?
SecRule REQUEST_URI "/modules\.php*name=Forums.*file=viewtopic*/forum=.*\'/" \
        "id:310286,rev:1,severity:2,msg:'JITP: PHPnuke modules.php SQL injection attempt'"

# Rule 310287:  WAnewsletter newsletter.php file include attempt
SecRule REQUEST_URI "newsletter\.php*waroot*start\.php" \
        "id:310287,rev:1,severity:1,msg:'JITP: WAnewsletter newsletter.php local file inclusion attempt'"

# Rule 310288:   Typo3 translations.php file include
SecRule REQUEST_URI "/translations\.php*ONLY" \
        "id:310288,rev:1,severity:1,msg:'JITP: Typo3 translations.php local file inclusion attempt'"

# Rule 310289:  PHP-Nuke remote file include attempt
SecRule REQUEST_URI "/index\.php*file=*(?:http|https|ftp)\:/" \
        "id:310289,rev:1,severity:2,msg:'JITP: PHPnuke index.php remote file inclusion attempt'"

# Rule 310290:  PayPal Storefront remote file include attempt
SecRule REQUEST_URI "do=ext*/page=(?:http|https|ftp)\:/" \
        "id:310290,rev:1,severity:2,msg:'JITP: PayPal storefront remote file inclusion attempt'"

# Rule 310291:  PHPOpenChat 
SecRule REQUEST_URI "/poc_loginform\.php\?phpbb_root_path=(?:http|https|ftp)\:/" \
        "id:310291,rev:1,severity:2,msg:'JITP: PHPOpenChat poc_loginform.php remote file inclusion attempt'"

# Rule 310292:  PHPOpenChat 
SecRule REQUEST_URI "/poc\.php\?phpbb_root_path=(?:http|https|ftp)\:/" \
        "id:310292,rev:1,severity:2,msg:'JITP: PHPOpenChat poc.php remote file inclusion attempt'"

# Rule 310293:  PHPOpenChat 
SecRule REQUEST_URI "/poc\.php\?poc_root_path=(?:http|https|ftp)\:/" \
        "id:310293,rev:1,severity:2,msg:'JITP: PHPOpenChat poc.php remote file inclusion attempt'"

# Rule 310294:  PHPOpenChat 
SecRule REQUEST_URI "/ENGLISH_poc\.php\?poc_root_path=(?:http|https|ftp)\:/" \
        "id:310294,rev:1,severity:2,msg:'JITP: PHPOpenChat ENGLISH_poc.php remote file inclusion attempt'"

# Rule 310295:  PHPOpenChat 
SecRule REQUEST_URI "/poc\.php\?sourcedir=(?:http|https|ftp)\:/" \
        "id:310295,rev:1,severity:2,msg:'JITP: PHPOpenChat poc.php remote file inclusion attempt'"

# Rule 310296: ACS Blog Search.ASP Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/search\.asp\?search=.*iframe\+src.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|http|https|ftp)\:/" \
        "id:310296,rev:1,severity:2,msg:'JITP: ACS Blog search.asp cross-site-scripting attempt'"

# Rule 310297: mcNews Remote command execution
SecRule REQUEST_URI "/admin/install\.php\?l=(?:http|https|ftp)\:/" \
        "id:310297,rev:1,severity:1,msg:'JITP: mcNews install.php remote command execution attempt'"

# Rule 310298: mailman XSS
SecRule REQUEST_URI|REQUEST_BODY "/mailman/.*\?.*info=*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>" \
        "id:310298,rev:1,severity:2,msg:'JITP: Mailman cross-site-scripting attempt'"

# Rule 310299: Macromedia SiteSpring XSS
SecRule REQUEST_URI|REQUEST_BODY "/error/500error\.jsp.*et=*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>" \
        "id:310299,rev:1,severity:2,msg:'JITP: Macromedia SiteSpring 500error.jsp cross-site-scripting attempt'"

# Rule 310300: OWA phishing redirect
SecRule REQUEST_URI "/exchweb/bin/auth/owalogon\.asp\?url=(?:http|https)\:/" \
        "id:310300,rev:1,severity:2,msg:'JITP: Outlook Web Access owalogon.asp phishing redirect attempt'"

# Rule 310301: ads.cgi command execution attempt
SecRule REQUEST_URI "/ads\.cgi.*file=.*\.\./\.\./" \
        "id:310301,rev:1,severity:1,msg:'JITP: ads.cgi local command execution attempt'"

# Rule 310302: webdist.cgi arbitrary command attemp
SecRule REQUEST_URI "/webdist\.cgi.*distloc=(?:\|3B\||\x3B)" \
        "id:310302,rev:1,severity:1,msg:'JITP: webdist.cgi local command execution attempt'"

# Rule 310303: enter_bug.cgi arbitrary command attempt
SecRule REQUEST_URI "/enter_bug\.cgi.*who.*(?:\|3B\||\x3B)" \
        "id:310303,rev:1,severity:1,msg:'JITP: enter_bug.cgi local command execution attempt'"

# Rule 310304: cross site scripting HTML Image tag set to javascript attempt
SecRule REQUEST_URI|REQUEST_BODY "img src=javascript" \
        "id:310304,rev:1,severity:2,msg:'JITP: Generic Javascript-through-image tag cross-site-scripting attempt'"

# Rule 310305: b2 arbitrary command execution attempt
SecRule REQUEST_URI "/b2-include/.*b2inc.*http(?:\|3A\|//|\x3A)" \
        "id:310305,rev:1,severity:1,msg:'JITP: b2-include local command execution attempt'"

# Rule 310306: tomcat servlet mapping XSS
SecRule REQUEST_URI|REQUEST_BODY "/servlet/.*/org\.apache\." \
        "id:310306,rev:1,severity:2,msg:'JITP: b2-include local command execution attempt'"

# Rule 310307: RUNCMS,Exoops,CIAMOS highlight file access hole
SecRule REQUEST_URI "/class/debug/highlight\.php\?file=(?:/|\.\./)" \
        "id:310307,rev:1,severity:1,msg:'JITP: RUNCMS.Exoops.CIAMOS highlight.php file access attempt'"

# Rule 310308: TRG/CzarNews News Script Include File Hole Lets Remote Users
# 	Execute Arbitrary Commands
SecRule REQUEST_URI "/install/(?:article|authorall|comment|display|displayall.)\.php\?dir=(?:http|https|ftp):/" \
        "id:310308,rev:1,severity:1,msg:'JITP: TRG/CzarNews /install/* local command execution attempt'"

# Rule 310309: zpanel XSS
SecRule REQUEST_URI "/zpanel\.php\?page=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310309,rev:1,severity:2,msg:'JITP: zPanel zpanel.php cross-site-scripting attempt'"

# Rule 310310: zpanel SQL injection
SecRule REQUEST_URI "/zpanel\.php\?page=.*\'" \
        "id:310310,rev:1,severity:2,msg:'JITP: zPanel zpanel.php SQL injection attempt'"

# Rule 310311: Phorum HTTP Response Splitting Vulnerability
SecRule REQUEST_URI "/search\.php\?forum_id=.*\&search=.*\&body=.*Content-Length\:.*HTTP/1\.0.*Content-Type\:.*Content-Length\:" \
        "id:310311,rev:1,severity:2,msg:'JITP: Phorum search.php HTTP response splitting attempt'"

# Rule 310312: Subdreamer Light Global Variables SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php\?categoryid=.*\&.*_sectionid=.*\&.*_imageid=.*\'" \
        "id:310312,rev:1,severity:2,msg:'JITP: Subdreamer index.php SQL injection attempt'"

# Rule 310313: PhotoPost Pro
SecRule REQUEST_URI "/showgallery\.php\?cat=[0-9].*\&page=(?:http|https|ftp)\:/" \
        "id:310313,rev:1,severity:2,msg:'JITP: PhotoPost showgallery.php cross-site-scripting attempt'"

# Rule 310314: PhotoPost Pro
SecRule REQUEST_URI "/showgallery\.php\?si=(?:http|https|ftp)\:/" \
        "id:310314,rev:1,severity:2,msg:'JITP: PhotoPost showgallery.php cross-site-scripting attempt'"

# Rule 310315: PhotoPost Pro
SecRule REQUEST_URI "/showgallery\.php\?ppuser=[0-9].*\&cat=(?:http|https|ftp)\:/" \
        "id:310315,rev:1,severity:2,msg:'JITP: PhotoPost showgallery.php cross-site-scripting attempt'"

# Rule 310316: PhotoPost Pro
SecRule REQUEST_URI "/showgallery\.php\?cat=[0-9].*\'" \
        "id:310316,rev:1,severity:2,msg:'JITP: PhotoPost showgallery.php SQL injection attempt'"

# Rule 310317: PhotoPost Pro
SecRule REQUEST_URI "/showgallery\.php\?ppuser=[0-9].*\'.*\&cat=" \
        "id:310317,rev:1,severity:2,msg:'JITP: PhotoPost showgallery.php SQL injection attempt'"

# Rule 310318: betaparticle blog Discloses Database to Remote Users 
#	and Lets Remote Users Upload/Delete Arbitrary Files
SecRule REQUEST_URI "/bp/database/dbBlogMX\.mdb" \
        "id:310318,rev:1,severity:2,msg:'JITP: Betaparticle Blog dbBlogMX.mdb database access attempt'"

# Rule 310319: betaparticle blog Discloses Database to Remote Users 
SecRule REQUEST_URI "/Blog\.mdb" \
        "id:310319,rev:1,severity:2,msg:'JITP: Betaparticle Blog Blog.mdb database access attempt'"

# Rule 310320: Kayako eSupport Cross Site Scripting Vulnerability
SecRule REQUEST_URI "/eSupport/index.php\?_a=knowledgebase\&_j=questiondetails\&_i=[0-9].*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310320,rev:1,severity:2,msg:'JITP: Kayako eSupport index.php cross-site-scripting attempt'"

# Rule 310321: Kayako eSupport Cross Site Scripting Vulnerability
SecRule REQUEST_URI "/eSupport/index.php\?_a=knowledgebase\&_j=questionprint\&_i=[0-9].*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310321,rev:1,severity:2,msg:'JITP: Kayako eSupport index.php cross-site-scripting attempt'"

# Rule 310322: Kayako eSupport Remote Cross Site Scripting Vulnerability
SecRule REQUEST_URI "/eSupport/index.php\?_a=troubleshooter\&_c=[0-9].*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310322,rev:1,severity:2,msg:'JITP: Kayako eSupport index.php cross-site-scripting attempt'"

# Rule 310323: Kayako eSupport Remote Cross Site Scripting Vulnerability
SecRule REQUEST_URI "/eSupport/index.php\?_a=knowledgebase\&_j=subcat\&_i=[0-9].*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310323,rev:1,severity:2,msg:'JITP: Kayako eSupport index.php cross-site-scripting attempt'"

# Rule 310324:  phpSysInfo XSS vulns
SecRule REQUEST_URI "/index\.php\?sensor_program=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310324,rev:1,severity:2,msg:'JITP: phpSysInfo index.php cross-site-scripting attempt'"

# Rule 310325:  phpSysInfo XSS vulns
SecRule REQUEST_URI "/includes/system_footer\.php\?text[template]=\"\>.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310325,rev:1,severity:2,msg:'JITP: phpSysInfo system_footer.php cross-site-scripting attempt'"

# Rule 310326:  phpSysInfo XSS vulns
SecRule REQUEST_URI "/includes/system_footer\.php\?hide_picklist=.*\&VERSION=\<iframesrc=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310326,rev:1,severity:2,msg:'JITP: phpSysInfo system_footer.php cross-site-scripting attempt'"

# Rule 310327: DigitalHive Remote Unathenticated Software Re-install and
# 	Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/base\.php\?page=forum/msg\.php-afs-1-\"/\>\<script\>" \
        "id:310327,rev:1,severity:2,msg:'JITP: DigitalHive base.php cross-site-scripting attempt'"

# Rule 310328: DigitalHive Remote Unathenticated Software Re-install and
# 	Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/hive/base\.php\?page=membres\.php\&mt=\"/\>\<script\>" \
        "id:310328,rev:1,severity:2,msg:'JITP: DigitalHive base.php cross-site-scripting attempt'"

# Rule 310329: Topic Calendar Mod for phpBB Cross-Site Scripting Attack
SecRule REQUEST_URI "/calendar_scheduler\.php\?start=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310329,rev:1,severity:2,msg:'JITP: phpBB Topic Calendar calendar_scheduler.php cross-site-scripting attempt'"

# Rule 310330: phpSysInfo Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/index\.php\?sensor_program=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310330,rev:1,severity:2,msg:'JITP: phpSysInfo index.php cross-site-scripting attempt'"

# Rule 310331: phpSysInfo Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/includes/system_footer\.php\?text.*=\"\>.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310331,rev:1,severity:2,msg:'JITP: phpSysInfo system_footer.php cross-site-scripting attempt'"

# Rule 310332: phpSysInfo Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/includes/system_footer\.php\?text[template]=\"\>.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310332,rev:1,severity:2,msg:'JITP: phpSysInfo system_footer.php cross-site-scripting attempt'"

# Rule 310333: phpSysInfo Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/includes/system_footer\.php\?hide_picklist=.*=\<iframe src.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310333,rev:1,severity:2,msg:'JITP: phpSysInfo system_footer.php cross-site-scripting attempt'"

# Rule 310334: Interspire ArticleLive 2005 "ArticleId" Remote Cross-Site
# 	Scripting Vulnerability
SecRule REQUEST_URI "/articles/newcomment\?ArticleId=\"\>" \
        "id:310334,rev:1,severity:2,msg:'JITP: Interspire ArticleLive newcomment.php cross-site-scripting attempt'"

# Rule 310335: Dream4 Koobi CMS Index.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php\?p=articles&area=.*\'" \
        "id:310335,rev:1,severity:2,msg:'JITP: Dream4 Koobi CMS index.php SQL injection attempt'"

# Rule 310336: Dream4 Koobi CMS Index.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php\?area.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310336,rev:1,severity:2,msg:'JITP: Dream4 Koobi CMS index.php SQL injection attempt'"

# Rule 310337: Vortex Portal Remote File Inclusion and Path Disclosure
# 	Vulnerabilities
SecRule REQUEST_URI "/index\.php\?act=(?:http|https|ftp)\:/" \
        "id:310337,rev:1,severity:2,msg:'JITP: Dream4 Koobi CMS index.php remote file inclusion attempt'"

# Rule 310338: Vortex Portal Remote File Inclusion and Path Disclosure
# 	Vulnerabilities
SecRule REQUEST_URI "/content\.php\?act=(?:http|https|ftp)\:/" \
        "id:310338,rev:1,severity:2,msg:'JITP: Dream4 Koobi CMS content.php remote file inclusion attempt'"

# Rule 310339: Topic Calendar Cross Site Scripting
SecRule REQUEST_URI "/calendar_scheduler\.php\?start.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310339,rev:1,severity:2,msg:'JITP: Topic Calendar calendar_scheduler.php cross-site-scripting attempt'"

# Rule 310340: ESMI PayPal Storefront SQL inject and XSS
SecRule REQUEST_URI "/ecdis/pages.php?idpages=\'" \
        "id:310340,rev:1,severity:2,msg:'JITP: ESMI Paypal Storefront pages.php SQL injection attempt'"

# Rule 310341: ESMI PayPal Storefront SQL inject and XSS
SecRule REQUEST_URI "/ecdis/products.*.php?id=.*&id.*=\'" \
        "id:310341,rev:1,severity:2,msg:'JITP: ESMI Paypal Storefront products.php SQL injection attempt'"

# Rule 310342: ESMI PayPal Storefront SQL inject and XSS
SecRule REQUEST_URI "/ecdis/products.*\.php\?id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310342,rev:1,severity:2,msg:'JITP: ESMI Paypal Storefront products.php cross-site-scripting attempt'"

# Rule 310343: Nuke Bookmarks modules.php SQL Injection Vulnerability
SecRule REQUEST_URI "modules\.php\?name=Bookmarks\&file=marks\&catname=.*\&category=.*/\*\*/(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9| ]+[[:space:]](?:from|into|table|database|index|view)" \
        "id:310343,rev:1,severity:2,msg:'JITP: PostNuke bookmarks modules.php SQL injection attempt'"

# Rule 310344: Nuke Bookmarks XSS
SecRule REQUEST_URI "/modules\.php\?name=Bookmarks\&file=(?:del_cat\&catname|del_mark\&markname|edit_cat\&catname|edit_cat\&catcomment|marks\&catname|uploadbookmarks\&category)=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310344,rev:1,severity:2,msg:'JITP: PostNuke bookmarks modules.php cross-site-scripting attempt'"

# Rule 310345:possible new vuln in tikiwiki
SecRule REQUEST_URI "/tiki-list_faqs\.php\?offset=(?:http|https|ftp)\:/" \
        "id:310345,rev:1,severity:2,msg:'JITP: TikiWiki tiki-list_faqs.php cross-site-scripting attempt'"

# Rule 310346:exoops Input Validation Flaws SQL injection and XSS
SecRule REQUEST_URI "/newbb/index\.php\?viewcat=\'" \
        "id:310346,rev:1,severity:2,msg:'JITP: eXoops index.php SQL injection attempt'"

# Rule 310347:exoops Input Validation Flaws SQL injection and XSS
SecRule REQUEST_URI "/modules/sections/index\.php\?op=viewarticle&artid=9\x2c+9\x2c+9" \
        "id:310347,rev:1,severity:2,msg:'JITP: eXoops sections/index.php cross-site-scripting attempt'"

# Rule 310348:exoops Input Validation Flaws SQL injection and XSS
SecRule REQUEST_URI "/newbb/viewforum\.php\?sortname=p\.post_time\&sortorder=.*\&sortdays=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310348,rev:1,severity:2,msg:'JITP: eXoops viewforum.php cross-site-scripting attempt'"

# Rule 310349:exoops Input Validation Flaws SQL injection and XSS
SecRule REQUEST_URI "/newbb/index\.php\?viewcat=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310349,rev:1,severity:2,msg:'JITP: eXoops index.php cross-site-scripting attempt'"

# Rule 310350: Valdersoft Shopping Cart SQL injection and XSS
SecRule REQUEST_URI "/(?:item|category).php?sid=.*\&id=\'" \
        "id:310350,rev:1,severity:2,msg:'JITP: Valdersoft Shopping Cart (item,category).php SQL injection attempt'"

# Rule 310351: Valdersoft Shopping Cart SQL injection and XSS
SecRule REQUEST_URI "/index\.php\?sid=.*\&lang=\'" \
        "id:310351,rev:1,severity:2,msg:'JITP: Valdersoft Shopping Cart index.php SQL injection attempt'"

# Rule 310352: Valdersoft Shopping Cart SQL injection and XSS
SecRule REQUEST_URI "/search_result\.php\?sid=.*\&search.*\'" \
        "id:310352,rev:1,severity:2,msg:'JITP: Valdersoft Shopping Cart search_result.php SQL injection attempt'"

# Rule 310353:OSCommerce XSS
SecRule REQUEST_URI "/default\.php\?(?:error_message|info_message)=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310353,rev:1,severity:2,msg:'JITP: OSCommerce default.php cross-site-scripting attempt'"

# Rule 310354:Typo3 remote file retrieval
SecRule REQUEST_URI "/dev/translations\.php\?ONLY=\x2e\x2e/\x2e\x2e/\x2e\x2e/\x2e\x2e/\x2e\x2e/.*\x00" \
        "id:310354,rev:1,severity:2,msg:'JITP: Type3 translations.php remote file retrieval attempt'"

# Rule 310355:Mambo XSS
SecRule REQUEST_URI "/emailfriend/(?:emailarticle|emailfaq|emailnews)\.php" \
        "chain,id:310355,rev:1,severity:2,msg:'JITP: Mambo email(article,faq,news).php cross-site-scripting attempt'"
SecRule ARGS:id "(?:\<script|(?:ht|f)tps?\:/)" 

# Rule 310356:Photopost XSS and sql injection
SecRule REQUEST_URI "photos/(?:showgallery|showmembers|slideshow)\.php\?.*\' " \
        "id:310356,rev:1,severity:2,msg:'JITP: Photopost SQL injection attempt'"

# Rule 310357:Photopost XSS and sql injection
SecRule REQUEST_URI "photos/(?:showgallery|showmembers|slideshow)\.php" \
        "chain,id:310357,rev:1,severity:2,msg:'JITP: Photopost cross-site-scripting attempt'"
SecRule ARGS "(?:\<script|(?:ht|f)tps?\:/)" 

# Rule 310358:TKai's Shoutbox XSS
SecRule REQUEST_URI "/shoutact\.php\?yousay=default\&query=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310358,rev:1,severity:2,msg:'JITP: TKais Shoutbox shoutact.php cross-site-scripting attempt'"

# Rule 310359:TKai's Shoutbox XSS
SecRule REQUEST_URI "/shoutact\.php\?yousay=default\&name=default&query=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310359,rev:1,severity:2,msg:'JITP: TKais Shoutbox shoutact.php cross-site-scripting attempt'"

# Rule 310360:TKai's Shoutbox XSS
SecRule REQUEST_URI "/shoutact\.php\?yousay=default\&email=default\&query=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310360,rev:1,severity:2,msg:'JITP: TKais Shoutbox shoutact.php cross-site-scripting attempt'"

# Rule 310361:TKai's Shoutbox XSS
SecRule REQUEST_URI "/shoutact\.php\?yousay=default\&email=default\&name=default\&query=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310361,rev:1,severity:2,msg:'JITP: TKais Shoutbox shoutact.php cross-site-scripting attempt'"

# Rule 310362:TKai's Shoutbox XSS
SecRule REQUEST_URI "/shoutact\.php\?yousay=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310362,rev:1,severity:2,msg:'JITP: TKais Shoutbox shoutact.php cross-site-scripting attempt'"

# Rule 310363:EncapsBB Remote File Inclusion Vulnerability
SecRule REQUEST_URI "/index_header.php?root=(?:http|https|ftp)\:/" \
        "id:310363,rev:1,severity:2,msg:'JITP: EncapsBB index_header.php remote file inclusion attempt'"

# Rule 310364:CPG Dragonfly CMS Two Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/index\.php\?name=.*\&profile=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310364,rev:1,severity:2,msg:'JITP: CPG Dragonfly CMS index.php cross-site-scripting attempt'"

# Rule 310365:CPG Dragonfly CMS Two Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/coppermine/displayimage/meta=lastcom/cat=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/).*/pos=.*\.html" \
        "id:310365,rev:1,severity:2,msg:'JITP: CPG Dragonfly CMS displayimage cross-site-scripting attempt'"

# Rule 310366:PHPCoin
SecRule REQUEST_URI "phpcoin/auxpage\.php\?page=\.\./\.\." \
        "id:310366,rev:1,severity:2,msg:'JITP: PHPcoin auxpage.php directory traversal attempt'"

# Rule 310367:PortalApp SQL injection and XSS
SecRule REQUEST_URI "/ad_click\.asp\?banner _id=\'" \
        "id:310367,rev:1,severity:2,msg:'JITP: PortalAPP ad_click.asp SQL injection attempt'"

# Rule 310368:PortalApp SQL injection and XSS
SecRule REQUEST_URI "/content\.asp\?CatId=\'" \
        "id:310368,rev:1,severity:2,msg:'JITP: PortalAPP content.asp SQL injection attempt'"

# Rule 310369:PortalApp SQL injection and XSS
SecRule REQUEST_URI "/content\.asp\?ContentId=\'" \
        "id:310369,rev:1,severity:2,msg:'JITP: PortalAPP content.asp SQL injection attempt'"

# Rule 310370:PortalApp SQL injection and XSS
SecRule REQUEST_URI "/content\.asp\?contenttype=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310370,rev:1,severity:2,msg:'JITP: PortalAPP content.asp cross-site-scripting attempt'"

# Rule 310371:PortalApp SQL injection and XSS
SecRule REQUEST_URI "/content\.asp\?do_search=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310371,rev:1,severity:2,msg:'JITP: PortalAPP content.asp cross-site-scripting attempt'"

# Rule 310372:Lighthouse Development Squirrelcart SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php\?crn=\'" \
        "id:310372,rev:1,severity:2,msg:'JITP: Lighthouse Squirrelcart index.php SQL injection attempt'"

# Rule 310373:PunBB version <= 1.2.2 auth bypass exploit
SecRule REQUEST_URI "profile\.php\?section=admin\&id=.*\&action=foo" \
        "id:310373,rev:1,severity:2,msg:'JITP: PunBB profile.php authentication bypass attempt'"

# Rule 310374:PunBB version <= 1.2.2 auth bypass exploit
SecRule REQUEST_COOKIES:punbb_cookie "a\:2\:\{i\:0\;s\:.*\;i\:1\;b\:1\;\}" \
        "id:310374,rev:1,severity:2,msg:'JITP: PunBB cookie manipulation authentication bypass attempt'"

# Rule 310375:Multiple SQL injection and XSS vulnerabilities in AspApp
SecRule REQUEST_URI "/content\.asp\?CatId=.*\&ContentType=(?:.*script|(?:http|https|ftp)\:/)" \
        "id:310375,rev:1,severity:2,msg:'JITP: AspAPP content.asp cross-sites-scripting attempt'"

# Rule 310376:Multiple SQL injection, and xss vulnerabilities in AspApp
SecRule REQUEST_URI "/content\.asp\?CatId=\'" \
        "id:310376,rev:1,severity:2,msg:'JITP: AspAPP content.asp SQL injection attempt'"

# Rule 310377:Multiple SQL injection, and xss vulnerabilities in AspApp
SecRule REQUEST_URI "/content\.asp\?contenttype=(?:.*script|(?:http|https|ftp)\:/)" \
        "id:310377,rev:1,severity:2,msg:'JITP: AspAPP content.asp cross-site-scripting attempt'"

# Rule 310378:PaFileDB Version 3.1 and below SQL injection and XSS
SecRule REQUEST_URI "/pafiledb\.php\?action=viewall&id=&start=\'" \
        "id:310378,rev:1,severity:2,msg:'JITP: PaFileDB pafiledb.php SQL injection attempt'"

# Rule 310379:PaFileDB Version 3.1 and below SQL injection and XSS
SecRule REQUEST_URI "/pafiledb\.php\?action=file&id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310379,rev:1,severity:2,msg:'JITP: PaFileDB pafiledb.php cross-site-scripting attempt'"

# Rule 310380:E-Data 2.0 XSS
SecRule REQUEST_URI "cgi-bin/dir\.pl.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310380,rev:1,severity:2,msg:'JITP: E-Data dir.pl cross-site-scripting attempt'"

# Rule 310381:PHPNuke general SQL injection
SecRule REQUEST_URI "/modules\.php\?.*name=.*UNION.*SELECT" \
        "id:310381,rev:1,severity:2,msg:'JITP: PHPnuke modules.php SQL injection attempt'"

# Rule 310382:InterAKT Online MX Kart Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php\?mod=pages&idp=\'" \
        "id:310382,rev:1,severity:2,msg:'JITP: InterAKT MX Kart index.php SQL injection attempt'"

# Rule 310383:InterAKT Online MX Kart Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/MXShop/\?mod=category&id_ctg=\'" \
        "id:310383,rev:1,severity:2,msg:'JITP: InterAKT MX Kart MXShop SQL injection attempt'"

# Rule 310384:InterAKT Online MX Kart Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php\?mod=category&id_ctg=\'" \
        "id:310384,rev:1,severity:2,msg:'JITP: InterAKT MX Kart index.php SQL injection attempt'"

# Rule 310385:InterAKT Online MX Kart Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php\?PHPSESSID=.*&id_man=\'" \
        "id:310385,rev:1,severity:2,msg:'JITP: InterAKT MX Kart index.php SQL injection attempt'"

# Rule 310386: CPG Dragonfly XSS
SecRule REQUEST_URI "/index\.php\?name=.*\&file=.*\&meta=.*\">.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310386,rev:1,severity:2,msg:'JITP: CPG Dragonfly index.php cross-site-scripting attempt'"

# Rule 310387: CPG Dragonfly XSS
SecRule REQUEST_URI "/index\.php\?name=.*\&mode=.*&id=.*\">.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310387,rev:1,severity:2,msg:'JITP: CPG Dragonfly index.php cross-site-scripting attempt'"

# Rule 310388: CPG Dragonfly XSS
SecRule REQUEST_URI "/coppermine/displayimage/meta=.*/cat=.*\">.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310388,rev:1,severity:2,msg:'JITP: CPG Dragonfly Coppermine cross-site-scripting attempt'"

# Rule 310389: CPG Dragonfly XSS
SecRule REQUEST_URI "/index\.php\?name=.*&profile=.*\">.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310389,rev:1,severity:2,msg:'JITP: CPG Dragonfly index.php cross-site-scripting attempt'"

#  Rule 310390:AlstraSoft EPay Pro Multiple Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/epal/\?order_num=crap&payment=\">.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310390,rev:1,severity:2,msg:'JITP: AlstraSoft EPay Pro epal cross-site-scripting attempt'"

#  Rule 310391:AlstraSoft EPay Pro Multiple Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/epal/\?order_num=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310391,rev:1,severity:2,msg:'JITP: AlstraSoft EPay Pro epal cross-site-scripting attempt'"

# Rule 310392:AlstraSoft EPay Pro Remote File Include Vulnerability
SecRule REQUEST_URI "/epal/index\.php\?view=(?:http|https|ftp)\:/" \
        "id:310392,rev:1,severity:2,msg:'JITP: AlstraSoft EPay Pro epal/index.php remote file inclusion attempt'"

# Rule 310393:SiteEnable XSS
SecRule REQUEST_URI "content\.asp\?contenttype=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310393,rev:1,severity:2,msg:'JITP: SiteEnable content.asp cross-site-scripting attempt'"

# Rule 310394:phpbb 2.0.13 download vuln
SecRule REQUEST_URI "/downloads\.php\?cat=.*(?:UNION|SELECT|delete|insert)*user_password.*phpbb_users" \
        "id:310394,rev:1,severity:2,msg:'JITP: phpBB downloads.php SQL injection attempt'"

# Rule 310395:Turnkey Websites Shopping Cart SQL injection
SecRule REQUEST_URI "/SearchResults\.php\?SearchTerm=\'" \
        "id:310395,rev:1,severity:2,msg:'JITP: Turnkey Shopping Cart SearchResults.php SQL injection attempt'"

# Rule 310396:Turnkey Websites Shopping Cart SQL injection
SecRule REQUEST_URI "/SearchResults\.php\?SearchTerm=.*\'" \
        "id:310396,rev:1,severity:2,msg:'JITP: Turnkey Shopping Cart SearchResults.php SQL injection attempt'"

# Rule 310397:Authentication bypass, Directory transversal and XSS
# 	vulnerabilities in PayProCart 3.0
SecRule REQUEST_URI "/usrdetails\.php\?sgnuptype=.*(?:(?:javsscript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310397,rev:1,severity:2,msg:'JITP: PayProCart v3.0 usrdetails.php authentication bypass attempt'"

# Rule 310398:Authenticaion bypass, Directory transversal and XSS
# 	vulnerabilities in PayProCart 3.0
SecRule REQUEST_URI "adminshop/index\.php\?proMod=index\&amp.*toedit=\.\..*shopincs.*maintopENG" \
        "id:310398,rev:1,severity:2,msg:'JITP: PayProCart v3.0 adminshop/index.php directory traversal attempt'"

# Rule 310399: PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12
SecRule REQUEST_URI "/banners\.php\?op=EmailStats&name=.*&bid=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310399,rev:1,severity:2,msg:'JITP: PHPnuke >=v7.6 banners.php cross-site-scripting attempt'"

# Rule 310400: PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12
SecRule REQUEST_URI "/modules\.php\?name=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310400,rev:1,severity:2,msg:'JITP: PHPnuke >=v7.6 modules.php cross-site-scripting attempt'"

# Rule 310401: PHP-Nuke Input Validation Flaws in Search, FAQ, and Banners
# 	Modules Permit Cross-Site Scripting Attacks
SecRule REQUEST_URI "/modules\.php\?name=Search&author=.*&topic=.*&min.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310401,rev:1,severity:2,msg:'JITP: PHPnuke >=v7.6 modules.php search cross-site-scripting attempt'"

# Rule 310402: PHP-Nuke Input Validation Flaws in Search, FAQ, and Banners Modules Permit Cross-Site Scripting Attacks
SecRule REQUEST_URI "/modules\.php\?name=FAQ&.*=.*&id_cat=.*&categories=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310402,rev:1,severity:2,msg:'JITP: PHPnuke >=v7.6 modules.php FAQ cross-site-scripting attempt'"

# Rule 310403: PHP-Nuke Input Validation Flaws in Search, FAQ, and Banners Modules Permit Cross-Site Scripting Attacks
SecRule REQUEST_URI "/modules\.php\?op=EmailStats&login=.*&cid=.*&bid=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310403,rev:1,severity:2,msg:'JITP: PHPnuke >=v7.6 modules.php EmailStats cross-site-scripting attempt'"

# Rule 310404: PHP-Nuke Input Validation Flaws in Search, FAQ, and Banners Modules Permit Cross-Site Scripting Attacks
SecRule REQUEST_URI "/modules\.php\?name=Encyclopedia&file=.*&op=.*&eid.*1&ltr=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310404,rev:1,severity:2,msg:'JITP: PHPnuke >=v7.6 modules.php Encyclopedia cross-site-scripting attempt'"

# Rule 310405: phpMyAdmin convcharset Parameter Cross Site Scripting
SecRule REQUEST_URI "/phpmyadmin/index\.php\?pma_username=*&pma_password=*&server=.*&lang=.*&convcharset=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310405,rev:1,severity:2,msg:'JITP: phpMyAdmin index.php convcharset parameter cross-site-scripting attempt'"

# Rule 310406: #phpBB Calendar Pro catergory Parameter SQL Injection
SecRule REQUEST_URI "/cal_view_month\.php\?month=.*&year=.*&category=.*(?:UNION|SELECT|DELETE|INSERT)" \
        "id:310406,rev:1,severity:2,msg:'JITP: phpBB cal_view_month.php SQL injection attempt'"

# Rule 310407: cubecart SQL injection
SecRule REQUEST_URI "/index\.php\?&PHPSESSID=\'" \
        "id:310407,rev:1,severity:2,msg:'JITP: Cubecart index.php SQL injection attempt'"

# Rule 310408: cubecart SQL injection
SecRule REQUEST_URI "/tellafriend\.php\?&product=\'" \
        "id:310408,rev:1,severity:2,msg:'JITP: Cubecart tellafriend.php SQL injection attempt'"

# Rule 310409: cubecart SQL injection
SecRule REQUEST_URI "/view_cart\.php\?add=\'" \
        "id:310409,rev:1,severity:2,msg:'JITP: Cubecart view_cart.php SQL injection attempt'"

# Rule 310410: cubecart SQL injection
SecRule REQUEST_URI "/view_product\.php\?product=\'" \
        "id:310410,rev:1,severity:2,msg:'JITP: Cubecart view_product.php SQL injection attempt'"

# Rule 310411:PHPBB Links Pro Module SQL Injection Vulnerability
SecRule REQUEST_URI "/links\.php\?func=show&id=\'" \
        "id:310411,rev:1,severity:2,msg:'JITP: phpBB links.php SQL injection attempt'"

# Rule 310412:LiteCommerce Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/cart\.php\?target=\'" \
        "id:310412,rev:1,severity:2,msg:'JITP: LiteCommerce cart.php SQL injection attempt'"

# Rule 310413:LiteCommerce Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/cart\.php\?target=category&category_id=\'" \
        "id:310413,rev:1,severity:2,msg:'JITP: LiteCommerce cart.php SQL injection attempt'"

# Rule 310414:LiteCommerce Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/cart\.php\?target=product&product_id=\'" \
        "id:310414,rev:1,severity:2,msg:'JITP: LiteCommerce cart.php SQL injection attempt'"

# Rule 310415:PHP-Nuke "querylang" SQL Injection Vulnerability
SecRule REQUEST_URI "/modules\.php\?name=Top&querylang=.*(?:UNION|SELECT|DELETE|INSERT).*\," \
        "id:310415,rev:1,severity:2,msg:'JITP: PHPnuke modules.php querylang SQL injection attempt'"

# Rule 310416:PHPBB DLMan Pro Module SQL Injection Vulnerability
SecRule REQUEST_URI "/dlman\.php\?func=file_info&file_id=\'" \
        "id:310416,rev:1,severity:2,msg:'JITP: phpBB dlman.php SQL injection attempt'"

# Rule 310417:ModernBill XSS and file include
SecRule REQUEST_URI "/samples/news\.php\?DIR=(?:http|https|ftp)\:/" \
        "id:310417,rev:1,severity:2,msg:'JITP: ModernBill news.php file inclusion attempt'"

# Rule 310418:ModernBill XSS and file include
SecRule REQUEST_URI|REQUEST_BODY "/order/orderwiz\.php\?v=.*&aid=.*(?:<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>|(?:http|https|ftp)\:/)" \
        "id:310418,rev:1,severity:2,msg:'JITP: ModernBill news.php cross-site-scripting attempt'"

# Rule 310419:TowerBlog! Discloses Hashed Administrative Password to Remote
# 	Users
SecRule REQUEST_URI|REQUEST_BODY "/_dat/login" \
        "id:310419,rev:1,severity:2,msg:'JITP: TowerBlog! _dat/login password hash disclosure attempt'"

# Rule 310420:Invision Power Board SQL injection
SecRule REQUEST_URI "/forums/index\.php\?act=.*&max_results=.*&filter=.*&sort_order=.*&sort_key=.*&st=*(?:UNION|SELECT|DELETE|INSERT)" \
        "id:310420,rev:1,severity:2,msg:'JITP: Invision Poweboard index.php SQL injection attempt'"

# Rule 310421:SQL injection in jPortal version 2.3.1
SecRule REQUEST_URI "/jportal/banner\.php*(?:UNION|SELECT|DELETE|INSERT)" \
        "id:310421,rev:1,severity:2,msg:'JITP: jPortal banner.php SQL injection attempt'"

# Rule 310422:PinnacleCart XSS Attack
SecRule REQUEST_URI "/index\.php\?p=catalog&parent=.*&pg=\">" \
        "id:310422,rev:1,severity:2,msg:'JITP: PinnacleCart index.php cross-site-scripting attempt'"

# Rule 310423:Serendipity exit.php SQL injection
SecRule REQUEST_URI "exit\.php\?entry_id=.*&url_id=.*\x20UNION\x20SELECT\x20(?:password|username)\x20FROM" \
        "id:310423,rev:1,severity:2,msg:'JITP: Serendipity exit.php SQL injection attempt'"

# Rule 310424:phpbb plus
SecRule REQUEST_URI "/groupcp\.php\?g=.*sid=\'" \
        "id:310424,rev:1,severity:2,msg:'JITP: phpBB groupcp.php SQL injection attempt'"

# Rule 310425:phpbb plus
SecRule REQUEST_URI "/index\.php\?(?:c|mark)=*\'" \
        "id:310425,rev:1,severity:2,msg:'JITP: phpBB index.php SQL injection attempt'"

# Rule 310426:phpbb plus
SecRule REQUEST_URI "/portal\.php\?article=*\'" \
        "id:310426,rev:1,severity:2,msg:'JITP: phpBB portal.php SQL injection attempt'"

# Rule 310427:phpbb plus
SecRule REQUEST_URI "/viewforum.php?f=.*sid=\'" \
        "id:310427,rev:1,severity:2,msg:'JITP: phpBB viewforum.php SQL injection attempt'"

# Rule 310428:phpbb plus
SecRule REQUEST_URI "/viewtopic.php?p=.*sid=\'" \
        "id:310428,rev:1,severity:2,msg:'JITP: phpBB viewtopic.php SQL injection attempt'"

# Rule 310429:phpbb plus
SecRule REQUEST_URI "/album_search\.php\?mode=\'" \
        "id:310429,rev:1,severity:2,msg:'JITP: phpBB viewtopic.php SQL injection attempt'"

# Rule 310430:phpbb plus
SecRule REQUEST_URI "/album_cat\.php\?cat_id=.*sid=\'" \
        "id:310430,rev:1,severity:2,msg:'JITP: phpBB album_cat.php SQL injection attempt'"

# Rule 310431:phpbb plus
SecRule REQUEST_URI "/album_comment\.php\?pic_id=.*sid=\'" \
        "id:310431,rev:1,severity:2,msg:'JITP: phpBB album_comment.php SQL injection attempt'"

# Rule 310432:phpbb plus
SecRule REQUEST_URI "calendar_scheduler\.php\?d=.*&mode=&start=\'\">" \
        "id:310432,rev:1,severity:2,msg:'JITP: phpBB calendar_scheduler.php SQL injection attempt'"

# Rule 310433: EasyPHPCalendar XSS
SecRule REQUEST_URI "/index\.php\?mo=.*&yr=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310433,rev:1,severity:2,msg:'JITP: EasyPHPCalendar index.php cross-site-scripting attempt'"

# Rule 310434: CalendarScript path discolsure and XSS
SecRule REQUEST_URI "/calendar\.pl\?calendar=.*&template=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310434,rev:1,severity:2,msg:'JITP: CalendarScript calendar.pl cross-site-scripting attempt'"

# Rule 310435: CalendarScript path discolsure and XSS
SecRule REQUEST_URI "/calendar\.pl\?calendar=.*&command=login&username=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310435,rev:1,severity:2,msg:'JITP: CalendarScript calendar.pl cross-site-scripting attempt'"

# Rule 310436: SPHPBlog Search.PHP Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/search\.php\?q=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|(?:http|https|ftp)\:/)" \
        "id:310436,rev:1,severity:2,msg:'JITP: SPHPBlog search.php cross-site-scripting attempt'"

# Rule 310437:All4WWW-Homepagecreator
SecRule REQUEST_URI "/index.php?site=(?:http|https|ftp)\:/" \
        "id:310437,rev:1,severity:2,msg:'JITP: All4WWW Homepage Creator index.php remote file inclusion attempt'"

# Rule 310438:zOOM Media Gallery SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php\?option=com_zoom&Itemid=.*&catid=*(?:AND|OR|INSERT|UNION|DELETE)" \
        "id:310438,rev:1,severity:2,msg:'JITP: zOOM Media Gallery index.php SQL injection attempt'"

# Rule 310439:caught in honeypot
SecRule REQUEST_URI ".*\.php\?(?:do=.*&template=\{\$\{|inc=(?:http|https|ftp)\:/)" \
        "id:310439,rev:1,severity:2,msg:'JITP: Unknown generic PHP remote file inclusion via template substitution attempt'"

# Rule 310440:phpMyAdmin path vln
SecRule REQUEST_URI "/css/phpmyadmin\.css\.php\?GLOBALS\[cfg\]\[ThemePath\]=/etc" \
        "id:310440,rev:1,severity:1,msg:'JITP: phpMyAdmin phpmyadmin.css.php local file access attempt'"

# Rule 310441:PHP-Nuke Web_Links Multiple Variable SQL Injection
SecRule SCRIPT_FILENAME "modules\.php" \
        "id:310441,rev:1,severity:2,msg:'JITP: PHP Nuke modules.php SQL injection attempt',chain"
SecRule ARGS:email|ARGS:ratenum|ARGS:min|ARGS:show|ARGS:orderby|ARGS:url "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310442:phpCOIN SQL injection
SecRule SCRIPT_FILENAME "mod\.php" \
        "id:310442,rev:1,severity:2,msg:'JITP: phpCOIN mod.php SQL injection attempt',chain"
SecRule ARGS:faq_id|ARGS:id|ARGS:topic_id|ARGS:ord_id|ARGS:dom_id|ARGS:invd_id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310443:NukeBookmarks  SQL injection
SecRule SCRIPT_FILENAME "modules\.php" \
        "id:310443,rev:1,severity:2,msg:'JITP: Nukebookmarks modules.php SQL injection attempt',chain"
SecRule ARGS:category "(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310444:e107 SQL injection
SecRule SCRIPT_FILENAME "news\.php" \
        "id:310444,rev:1,severity:2,msg:'JITP: e107 news.php SQL injection attempt',chain"
SecRule ARGS:list "(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310445:squirrelcart SQL injection
SecRule SCRIPT_FILENAME "index\.php" \
        "id:310445,rev:1,severity:2,msg:'JITP: Squirrelcart index.php SQL injection attempt',chain"
SecRule ARGS:crn "(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(?:from|into|table|database|index|view)"

# Rule 310446:PHP-Nuke HTTP Response Splitting vuln
SecRule REQUEST_URI "modules\.php\?name=Surveys&pollID=.*&forwarder=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310446,rev:1,severity:2,msg:'JITP: PHP Nuke modules.php HTTP response splitting attempt'"

# Rule 310447:AzDGDatingPlatinum view.php id Variable XSS
SecRule REQUEST_URI "/view\.php\?l=.*&id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310447,rev:1,severity:2,msg:'JITP: PHP Nuke modules.php cross-site-scripting attempt'"

# Rule 310448: AzDGDatingPlatinum index.php from Variable SQL Injection
SecRule REQUEST_URI "/members/index\.php\?l=.*&a=.*&from=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)" \
        "id:310448,rev:1,severity:2,msg:'JITP: AzDGDatingPlatinum index.php SQL injection attempt'"

# Rule 310449: AzDGDatingPlatinum view.php id Variable SQL Injection
SecRule REQUEST_URI "/view.php\?l=.*&id=.*\'" \
        "id:310449,rev:1,severity:2,msg:'JITP: AzDGDatingPlatinum view.php SQL injection attempt'"

# Rule 310450:PHPBB Remote Mod.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/moddb/mod\.php\?id=\'" \
        "id:310450,rev:1,severity:2,msg:'JITP: phpBB mod.php SQL injection attempt'"

# Rule 310451:CityPost PHP LNKX Input Validation Hole Permits Cross-Site
# 	Scripting Attacks
SecRule REQUEST_URI "/lnkx/message\.php\?msg=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310451,rev:1,severity:2,msg:'JITP: CityPost PHP LNKX message.php cross-site-scripting attempt'"

# Rule 310452:Coppermine Photo Gallery Multiple XSS
SecRule REQUEST_URI "/index\.php\?lang=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310452,rev:1,severity:2,msg:'JITP: Coppermine index.php cross-site-scripting attempt'"

# Rule 310453:PHP-Nuke Blind SQL Injection
SecRule REQUEST_URI "/modules\.php\?name=Downloads&d_op=.*&title=.*&url=.*&description=.*&email=\'\,*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)" \
        "id:310453,rev:1,severity:2,msg:'JITP: Coppermine index.php cross-site-scripting attempt'"

# Rule 310454:PHP-Nuke Blind SQL Injection
SecRule REQUEST_URI "/modules\.php\?name=Downloads&d_op=.*&url=\'\,*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)" \
        "id:310454,rev:1,severity:2,msg:'JITP: PHP Nuke modules.php blind SQL injection attempt'"

# Rule 310455:PHP-Nuke Blind SQL Injection
SecRule REQUEST_URI "/modules\.php\?name=Downloads&d_op=viewsdownload&min=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select)[[:space:]]+[A-Z|a-z|0-9|\*]+(?:from|into|table|database|index|view)" \
        "id:310455,rev:1,severity:2,msg:'JITP: PHP Nuke modules.php blind SQL injection attempt'"

# Rule 310456:PHP-Nuke Blind SQL Injection
SecRule REQUEST_URI "/modules\.php\?name=Downloads&d_op=search&min=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)" \
        "id:310456,rev:1,severity:2,msg:'JITP: PHP Nuke modules.php blind SQL injection attempt'"

# Rule 310457:UBB Thread /ubbthreads/printthread.php SQL Injection Yes/No
# 	vulnerability
SecRule REQUEST_URI "/printthread\.php*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)" \
        "id:310457,rev:1,severity:2,msg:'JITP: UBB Thread printthread.php SQL injection attempt'"

# Rule 310458:Coppermine remote file inclusion
SecRule REQUEST_URI "/theme\.php\?THEME_DIR=(?:http|https|ftp)/:/" \
        "id:310458,rev:1,severity:2,msg:'JITP: Coppermine theme.php remote file inclusion attempt'"

# Rule 310459:E-Cart Mod remote command execution
SecRule REQUEST_URI "/index\.cgi\?action=.*&cat=.*&art=.*\|" \
        "id:310459,rev:1,severity:1,msg:'JITP: E-Cart index.cgi local command execution attempt'"

# Rule 310460:phpBB Auction Mod SQL injection
SecRule REQUEST_URI "/auction_rating\.php\?mode=.*&u=.*\'" \
        "id:310460,rev:1,severity:2,msg:'JITP: phpBB auction_rating.php SQL injection attempt'"

# Rule 310461:phpBB Auction Mod SQL injection
SecRule REQUEST_URI "/auction_offer\.php\?mode=.*&ar=.*\'" \
        "id:310461,rev:1,severity:2,msg:'JITP: phpBB auction_offer.php SQL injection attempt'"

# Rule 310462:kali's tagboard remote command execution
SecRule REQUEST_URI "/admin/banned\.php\?&cmd=" \
        "id:310462,rev:1,severity:1,msg:'JITP: Kalis Tagboard banned.php local command execution attempt'"

# Rule 310463:PHPBB Profile.PHP Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/profile\.php\?mode=viewprofile&u=.*(?:(?:script|script|about|applet|activex|chrome)\>|html|(?:http|https|ftp)\:/)" \
        "id:310463,rev:1,severity:2,msg:'JITP: phpBB profile.php cross-site-scripting attempt'"

# Rule 310464:PHPBB Viewtopic.PHP Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/viewtopic\.php\?p=.*&highlight=.*(?:(?:script|script|about|applet|activex|chrome)\>|html|(?:http|https|ftp)\:/)" \
        "id:310464,rev:1,severity:2,msg:'JITP: phpBB viewtopic.php cross-site-scripting attempt'"

# Rule 310465:Netref Remote Arbitrary File Creation Vulnerability
SecRule REQUEST_URI "script/cat_for_gen\.php" \
        "id:310465,rev:1,severity:1,msg:'JITP: Netref cat_for_gen.php local file creation attempt'"

# Rule 310466: eGroupWare index.php cats_app Variable SQL Injection
SecRule REQUEST_URI "/index\.php\?menuaction=preferences\.uicategories\.index\&cats_app=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)" \
        "id:310466,rev:1,severity:2,msg:'JITP: eGroupWare index.php SQL injection attempt'"

# Rule 310467: eGroupWare tts/index.php filter Variable SQL Injection
SecRule REQUEST_URI "/tts/index\.php\?filter=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)" \
        "id:310467,rev:1,severity:2,msg:'JITP: eGroupWare tts/index.php SQL injection attempt'"

# Rule 310468: eGroupWare sitemgr-site/index.php category_id Variable XSS
SecRule REQUEST_URI "/sitemgr/sitemgr-site/\?category_id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310468,rev:1,severity:2,msg:'JITP: eGroupWare sitemgr-site/index.php cross-site-scripting attempt'"

# Rule 310469: eGroupWare wiki/index.php Multiple Variable XSS
SecRule REQUEST_URI "/index\.php\?page=RecentChanges.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310469,rev:1,severity:2,msg:'JITP: eGroupWare wiki/index.php cross-site-scripting attempt'"

# Rule 310470: eGroupWare wiki/index.php Multiple Variable XSS
SecRule REQUEST_URI "/index\.php\?action=history&page=.*&lang=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310470,rev:1,severity:2,msg:'JITP: eGroupWare wiki/index.php cross-site-scripting attempt'"

# Rule 310471: eGroupWare index.php Multiple Variable XSS
SecRule REQUEST_URI "/index\.php\?menuaction=addressbook\.uiaddressbook\.edit\&ab_id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310471,rev:1,severity:2,msg:'JITP: eGroupWare index.php cross-site-scripting attempt'"

# Rule 310472: eGroupWare index.php Multiple Variable XSS
SecRule REQUEST_URI "/index\.php\?menuaction=manual\.uimanual\.view\&page=ManualAddressbook.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310472,rev:1,severity:2,msg:'JITP: eGroupWare index.php cross-site-scripting attempt'"

# Rule 310473: eGroupWare index.php Multiple Variable XSS
SecRule REQUEST_URI "/index\.php\?menuaction=forum\.uiforum\.post\&type=new.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310473,rev:1,severity:2,msg:'JITP: eGroupWare index.php cross-site-scripting attempt'"

# Rule 310474: eGroupWare index.php Multiple Variable XSS
SecRule REQUEST_URI "/index\.php\?menuaction=wiki\.uiwiki\.edit\&page=setup.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)" \
        "id:310474,rev:1,severity:2,msg:'JITP: eGroupWare index.php cross-site-scripting attempt'"

# Rule 310475:SQL Injections in MetaBid Auctions
SecRule REQUEST_URI "/item\.asp\?intAuctionID=\'" \
        "id:310475,rev:1,severity:2,msg:'JITP: MetaBid item.asp SQL injection attempt'"

# Rule 310476:honeypot catch
SecRule REQUEST_URI "tiki-print\.php\?page=(?:http|https|ftp)\:/" \
        "id:310476,rev:1,severity:2,msg:'JITP: Tikiwiki tiki-print.php cross-site-scripting attempt'"

# Rule 310477: phpBB Notes Mod SQL Injection Vulnerability
SecRule REQUEST_URI "/posting_notes\.php\?mode=editpost\&*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)" \
        "id:310477,rev:1,severity:2,msg:'JITP: phpBB notes module posting_notes.php SQL injection attempt'"

# Rule 310478:phpCOIN SQL injection attacks
SecRule REQUEST_URI "/index\.php\?title=.*&search=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)" \
        "id:310478,rev:1,severity:2,msg:'JITP: phpCOIN index.php SQL injection attempt'"

# Rule 310479:phpCOIN SQL injection attacks
SecRule REQUEST_URI "/login\.php\?w=.*&o=.*&phpcoinsessid=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)*\'" \
        "id:310479,rev:1,severity:2,msg:'JITP: phpCOIN login.php SQL injection attempt'"

# Rule 310480:phpCOIN SQL injection attacks
SecRule REQUEST_URI "/mod\.php\?mod=siteinfo&id=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)*\'&phpcoinsessid=" \
        "id:310480,rev:1,severity:2,msg:'JITP: phpCOIN mod.php SQL injection attempt'"

# Rule 310019:phpCOIN SQL injection attacks
SecRule REQUEST_URI "/mod\.php\?mod=pages&mode=list&(?:dcat_id|topic_id)=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)*\'\&phpcoinsessid=" 

# Rule 310019:honeypot catch
SecRule REQUEST_URI "/index\.php\?page=(?:http|https|ftp)\:/"

# Rule 310019: honeypot catch
#ideabox code injection
SecRule REQUEST_URI "/ideabox/include\.php" chain
SecRule REQUEST_URI  "(?:Dir=(?:http|https|ftp)\:/|\?\&(?:cmd|id|inc|name)=)"

# Rule 310019: 12Planet Chat Server Path Disclosure
# CVE: "CVE-MAP-NOMATCH"
SecRule REQUEST_URI "/qwe/qwe/index\.html"

# Rule 310019: Agora CGI Cross Site Scripting
# CVE: "CVE-2001-1199"
SecRule REQUEST_URI  "/store/agora\.cgi\?cart_id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: Apache Remote Command Execution via .bat files
# CVE: "CVE-2002-0061"
SecRule REQUEST_URI  "/test-cgi\.bat\?\|"

# Rule 310019: cpanel remote command execution
SecRule REQUEST_URI "/cgi-sys/guestbook\.cgi\?user=cpanel&template=\|"

# Rule 310019: Oracle 9iAS mod_plsql directory traversal
# CVE: "CAN-2001-1217"
SecRule REQUEST_URI  "/pls/sample/admin_/help/\.\."

# Rule 310019: Zeus Admin Interface XSS
SecRule REQUEST_URI "/apps/web/vs_diag\.cgi\?server=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: Oracle 9iAS iSQLplus XSS
SecRule REQUEST_URI|REQUEST_BODY "/isqlplus\?action=logon&username=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019:  main.cgi directory traversal and file access
SecRule REQUEST_URI "/main\.cgi\?next_file=*/"

# Rule 310019: TorrentTrader SQL Injection
SecRule REQUEST_URI "/download\.php\?id=\'"

# Rule 310019: OpenCA HTML Injection
# CVE: "CAN-2004-0787"
SecRule REQUEST_URI "/cgi-bin/pub/pki\?cmd=serverInfo"

# Rule 310019: pdesk directory traversal and file theft
SecRule REQUEST_URI "/cgi-bin/pdesk\.cgi\?lang=\.\./\.\./"

# Rule 310019: ShowCenter XSS
SecRule REQUEST_URI "/ShowCenter/SettingsBase\.php\?Skin=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: honeypot XSS attack
SecRule REQUEST_URI "/page\.php\?action=view&id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: i-mall remote command execution attack
SecRule REQUEST_URI "/i-mall/i-mall\.cgi\?p=\|"

# Rule 310019: PArser XSS
SecRule REQUEST_URI "/parser/parser\.php\?file=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: caught in honeypot
SecRule REQUEST_URI "/check_user_id\.php\?user_id=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: formmail probe
#SecRule REQUEST_URI|REQUEST_BODY "/formmail\.pl HTTP\/(?:0\.9|1\.0|1\.1)$"
SecRule REQUEST_URI|REQUEST_BODY "GET .*/formmail\.pl HTTP\/(?:0\.9|1\.0|1\.1)$"
# Rule 310019: formmail probe
SecRule REQUEST_URI|REQUEST_BODY "HEAD .*/formmail\.pl HTTP\/(?:0\.9|1\.0|1\.1)$"
# Rule 310019: formmail probe
SecRule REQUEST_URI|REQUEST_BODY "POST .*/formmail\.pl HTTP\/(?:0\.9|1\.0|1\.1)$" 

# Rule 310019: JGS-Portal ID Variable SQL Injection Vulnerability
SecRule REQUEST_URI "/jgs_portal\.php\?id=\'"

# Rule 310019: SitePanel 2 command exec, file access
SecRule REQUEST_URI "/users/index\.php\?lang=en\.inc/\.\./\.\./"
# Rule 310019: SitePanel 2 command exec, file access
SecRule REQUEST_URI "/users/main.php?p=(?:http|https|ftp)\:/"
# Rule 310019: SitePanel 2 command exec, file access
SecRule REQUEST_URI "/admin/5\.php\?do=rmattach&rm=yes&id=\.\./"

# Rule 310019: osTicket directory traversal
SecRule REQUEST_URI "/attachments\.php\?file=\.\./\.\."

# Rule 310019: osticket remote file inclusion
SecRule REQUEST_URI "/include/main\.php\?config.*=.*&include_dir=(?:http|https|ftp)\:/"

# Rule 310019: osticket SQL injection
SecRule REQUEST_URI "/admin\.php\?a=view&id=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]]+(?:from|into|table|database|index|view|select)"
# Rule 310019: osticket SQL injection
SecRule REQUEST_URI "/view\.php\?s=.*&query=*&cat=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019:Woltlab Burning Board JGS-Portal "id" SQL Injection
SecRule REQUEST_URI "/jgs_portal\.php" chain
SecRule REQUEST_URI  "id=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: eSKUeL "ConfLangCookie" and "lang_config" Local File Inclusion
SecRule REQUEST_URI "include/functions\.inc\.php" chain
SecRule REQUEST_URI  "(?:ConfLangCookie|lang_config)=*\.\./"

# Rule 310019: FishCart Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "display\.php" chain
SecRule REQUEST_URI  "nlst=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019:
SecRule REQUEST_URI "upstracking\.php" chain
SecRule REQUEST_URI  "(?:eqagree|m|trackingnum)=.*(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019:
SecRule REQUEST_URI "display\.php" chain
SecRule REQUEST_URI  "psku=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019:
SecRule REQUEST_URI "upstnt\.php" chain
SecRule REQUEST_URI  "cartid=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: vBulletin calendar.php comma Parameter Arbitrary Command Execution
SecRule REQUEST_URI "calendar\.php\?calbirthdays=.*&action=.*&day=.*&comma=*(?:cd|\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(?:download|request|mirror|rget)|id|uname|cvs|svn|(?:r|s)sh|(?:s|r)cp|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"
SecRule REQUEST_URI "/calendar\.php\?calbirthdays=.*&action=getday&day=.*&comma=\x22;"

# Rule 310019:FishCart SQL injection
SecRule REQUEST_URI "/display\.php\?cartid=.*&zid=*&lid=*&nlst=*&olimit=*&cat=*&key*=&psku=\'"
# Rule 310019:FishCart SQL injection
SecRule REQUEST_URI "/upstnt\.php\?zid=.*&lid=.*&cartid=\'"

# Rule 310019: PHP-Nuke "phpbb_root_path" Arbitrary File Inclusion
SecRule REQUEST_URI "/admin_styles\.php\?phpbb_root_path=(?:http|https|ftp)\:/"

# Rule 310019: Apache Jakarta-Tomcat? /admin Context Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/admin/\?op=\xc0"

# Rule 310019: generic Common HTTP vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/\?cwd=/"

# Rule 310019: XSS in phpBB
SecRule REQUEST_URI|REQUEST_BODY "/(?:viewtopic|privmsg|bbcode)\.php\?" chain
SecRule REQUEST_URI  "\[url=(?:script|javascript|about|applet|activex|chrome)\:/"

# Rule 310019: phbb admin forums XSS
SecRule REQUEST_URI "/admin_forums\.php\?" chain
SecRule REQUEST_URI|REQUEST_BODY  "\<[[:space:]]*(?:script|about|applet|activex|chrome)"

# Rule 310019: HTMLJunction EZGuestbook Remote Database Disclosure Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/datastores/guestbook\.mdb"

# Rule 310019: phpbb XSS
SecRule REQUEST_URI "/admin/admin_forums\.php\?sid=.*" chain
SecRule REQUEST_URI|REQUEST_BODY "(?:forumname|forumdesc)=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"

# Rule 310019: DirectTopics Topic.PHP SQL Injection Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/topic\.php\?topic=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: honeypot
SecRule REQUEST_URI "tiki-index\.php\?page=(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

# Rule 310019: Help Center Live Multiple Input Validation Vulnerabilities
SecRule REQUEST_URI "/faq/index\.php\?x=.*&id=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: Help Center Live Multiple Input Validation Vulnerabilities
SecRule REQUEST_URI "/tt/view\.php\?tid=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: Help Center Live Multiple Input Validation Vulnerabilities
SecRule REQUEST_URI "/tt/download\.php\?fid=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: Help Center Live Multiple Input Validation Vulnerabilities
SecRule REQUEST_URI "/lh/icon\.php\?status=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: Help Center Live Multiple Input Validation Vulnerabilities
SecRule REQUEST_URI "/lh/chat_download\.php\?fid=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal\.php\?anzahl_beitraege=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_statistik\.php\?meinaction=mitglieder&month=.*&year=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_statistik\.php\?meinaction=themen&month=.*&year=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_statistik\.php\?meinaction=beitrag&month=.*&year=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_beitraggraf\.php\?month=.*&year=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_viewsgraf\.php\?jahr=.*&monat=.*&tag=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+(?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_themengraf\.php\?month=.*&year=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_mitgraf\.php\?month=.*&year=.*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_sponsor\.php\?id=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities
SecRule REQUEST_URI "/jgs_portal_box\.php\?id=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: NPDS "comments.php" and "pollcomments.php" Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI "/npds/comments\.php\?thold=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: NPDS "comments.php" and "pollcomments.php" Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI "/npds/pollcomments\.php\?thold=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
# Rule 310019: NPDS "comments.php" and "pollcomments.php" Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI "/npds/pollcomments\.php\?op=results&pollID=2&mode=&order=&thold=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: Gurgens Guest Book Remote Database Disclosure Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/db/Genit\.dat"

# Rule 310019: PhotoPost Arbitrary Data vuln
SecRule REQUEST_URI "/member\.php\?ppaction=.*&verifykey=.*&uid=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: OpenBB SQL Injection Vulnerabilities
SecRule REQUEST_URI "/read\.php" chain
SecRule ARGS:TID "(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: PostNuke "func" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php.*func=*(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: Bug Report Script Insertion Vulnerability
SecRule SCRIPT_FILENAME "bug_report\.php" chain
SecRule ARGS:name|ARGS:sujet|ARGS:commentaries|ARGS:os|ARGS:navig|ARGS:url "<[[:space:]]*(?:script|about|applet|activex|chrome)"

# Rule 310019: NPDS SQL Injection and XSS Vulnerabilities
SecRule REQUEST_URI "/(?:pollcomments|comments)\.php" chain
SecRule ARGS:thold "(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"
SecRule REQUEST_URI "/faq\.php" chain
SecRule ARGS:categories "<[[:space:]]*(?:script|about|applet|activex|chrome)"

# Rule 310019: Post tiki Wiki install rules
SecRule REQUEST_URI "/tiki-install\.php"
# Rule 310019: Post tiki Wiki install rules
SecRule REQUEST_URI "/tiki-edit_templates\.php"

# Rule 310019: phpATM Arbitrary Remote File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php\?include_location=(?:http|https|ftp)\:/"

# Rule 310019: TOPo XSS vuln
SecRule REQUEST_URI "/index\.php\?m=(?:top|members)*<[[:space:]]*(?:script|about|applet|activex|chrome)"

# Rule 310019: honeypot
SecRule REQUEST_URI "/news\.php\?tpath=(?:http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI "tiki-(?:index|print)\.php\?page=.*\?include_location=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "tiki-.*\?include_location=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "tiki-editpage\.php\?page=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "tiki-export_wiki_pages\.php\?page=(?:http|https|ftp)\:/"

# Rule 310019: sawmill remote file access
SecRule REQUEST_URI|REQUEST_BODY "/cgi-bin/sawmill5\?.*\x22"

# Rule 310019: mailview CGI remote file access`
SecRule REQUEST_URI "mailview\.cgi\?cmd=view&fldrname=.*&select=.*&html=\.\./\.\."

# Rule 310019: Javamail info disclosure
SecRule REQUEST_URI "/Download\?/.*/web/WEB-INF/web\.xml"

# Rule 310019: javamail file access
SecRule REQUEST_URI|REQUEST_BODY "/Download\?(?:\.\./|/\.\./|/etc/|/home/|/tmp/|/usr/|/backup/|/dev/|/proc/|/var/(?:cache|spool|mail|adm|log|tmp)/)"

# Rule 310019: Gforge "viewFile.php" Remote Arbitrary Command Execution Vulnerability
SecRule REQUEST_URI "/viewFile\.php\?group_id=.*&file_name=\x0A"

# Rule 310019: WebAPP v0.9.9.2.1 Remote Command Execution vuln
SecRule REQUEST_URI "/apage\.cgi?f=.*\|"

# Rule 310019: honeypot
SecRule REQUEST_URI "/displayCategory\.php\?basepath=(?:http|https|ftp)\:/"

# Rule 310019: PHP Poll Creator Include File Error Lets Remote Users Execute Arbitrary Commands 
SecRule REQUEST_URI "/poll_vote\.php\?relativer_pfad=(?:http|https|ftp)\:/"

# Rule 310019: PostNuke version : x=> 0.750 SQL injection
SecRule REQUEST_URI "/modules\.php\?op=modload&name=Messages&file=readpmsg&start=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: SQL Injection Vuln for myBloggie 2.1.1 - 2.1.2
SecRule REQUEST_URI "index\.php\?month_no=.*&year=.*&mode=viewdate&date_no=*(?:delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view|select)"

# Rule 310019: powerdownload remote file include
SecRule REQUEST_URI "/downloads\.php\?release_id=.*&incdir=(?:http|https|ftp)\:/"

# Rule 310019: X-Cart SQL inject vulns
SecRule REQUEST_URI "/home\.php\?(?:cat|printable)=\'"
# Rule 310019: X-Cart SQL inject vulns
SecRule REQUEST_URI "/product\.php\?(?:product|mode)=\'"
# Rule 310019: X-Cart SQL inject vulns
SecRule REQUEST_URI "/error_message\.php\?access_denied&id=\'"
# Rule 310019: X-Cart SQL inject vulns
SecRule REQUEST_URI "/help\.php\?section=\'"
# Rule 310019: X-Cart SQL inject vulns
SecRule REQUEST_URI "/(?:orders|register|search)\.php\?mode=\'"
# Rule 310019: X-Cart SQL inject vulns
SecRule REQUEST_URI "/giftcert\.php\?(?:gcid|gcindex)=\'"

# Rule 310019: Calendarix Advanced
SecRule REQUEST_URI "/cal_week\.php\?op=week&catview=.*\'"
# Rule 310019: Calendarix Advanced
SecRule REQUEST_URI "/cal_cat\.php\?op=cats&catview=.*\'"
# Rule 310019: Calendarix Advanced
SecRule REQUEST_URI "/cal_day\.php\?op=.*&date=.*&catview=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: Calendarix Advanced
SecRule REQUEST_URI "/cal_pophols\.php\?id=.*\'"


# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/online\.php\?pidsql=\)(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/memberlist\.php\?usersearch=\%\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/editpost\.php\?pid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/forumdisplay\.php\?fid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/newreply\.php\?tid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/search\.php\?action=.*&(?:sid|uid)=*\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/showthread\.php\?(?:tp)id=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/usercp2\.php\?tid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/printthread\.php\?tid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/reputation\.php\?pid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/portal\.php\?action=do_login&username=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/polls\.php\?action=newpoll&tid=\'"
# Rule 310019: MyBulletinBoard SQL injection
SecRule REQUEST_URI "/ratethread\.php\?tid=\'"

# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/misc\.php\?action=syndication&forums.*=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/misc\.php\?action=syndication&forums.*=.*&version*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/misc\.php\?action=syndication&limit=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/forumdisplay\.php\?fid=.*&datecut=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/forumdisplay\.php\?fid=.*&page=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/member\.php\?agree=.*&username=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/member\.php\?agree=.*&(?:email|email2)=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/memberlist\.php\?(?:page|usersearch)=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/showthread\.php\?mode=linear&tid=.*&pid=*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/showthread\.php\?mode=linear&tid=.*\<[[:space:]]*(?:script|about|applet|activex|chrome)"
# Rule 310019: MyBulletinBoard XSS
SecRule REQUEST_URI "/printthread\.php?tid=.*\<[[:space:]]*(?:script|about|applet|activex|chrome)"

# Rule 310019: Wordpress SQL injection
SecRule REQUEST_URI "/wp-trackback\.php\?tb_id=*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: Wordpress SQL injection
SecRule REQUEST_URI "/wp-trackback\.php" chain
SecRule ARGS:tb_id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: Wordpress SQL injection
SecRule REQUEST_URI "/index\.php\?cat=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: MWChat remote file inclusion vuln
SecRule REQUEST_URI "/libs/start_lobby\.php\?CONFIG.*=(?:http|https|ftp)\:/"

# Rule 310019: phpCMS "class.layout_phpcms.php" Remote Arbitrary File Inclusion Vulnerability
SecRule REQUEST_URI "/parser\.php\?&phpcmsaction=FILEMANAGER&language=.*(?:/\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: Exhibit Engine Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "/search_row=ee_photo\.ee_photo_exif_iso.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: Exhibit Engine Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI "/list\.php" chain
SecRule ARGS:search_row|ARGS:sort_row|ARGS:order|ARGS:perpage "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019:  phpCMS "language" Local File Inclusion Vulnerability
SecRule SCRIPT_FILENAME "/parser\.php" chain
SecRule ARGS:laguage "/\.\./"

# Rule 310019: Popper "form" File Inclusion Vulnerability
SecRule REQUEST_URI "/childwindow\.inc\.php" chain
SecRule ARGS:form "(?:/\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: phpThumb() "src" Exposure of Sensitive Information
SecRule SCRIPT_FILENAME "/phpThumb\.php" chain
SecRule ARGS:src "/\.\./"

# Rule 310019: General [url] php forum protections (phpbb and others, to protect against script injection attacks in url links)
SecRule REQUEST_URI "\.php\?" chain
SecRule REQUEST_URI|REQUEST_BODY "\[url=(?:script|javascript|applet|about|chrome|activex)\:/.*\].*\[/url\]"

# Rule 310019: e107 eTrace Plugin Shell Command Injection Vulnerability
SecRule SCRIPT_FILENAME "/dotrace\.php" chain
SecRule ARGS:etrace_cmd|ARGS:etrace_host "(?:cd|\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(?:download|request|mirror|rget)|id|uname|cvs|svn|(?:r|s)(?:cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"

# Rule 310019: WebHints Shell Command Injection Vulnerability
SecRule REQUEST_URI "/hints\.pl.*\|"

# Rule 310019: Invision Gallery SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:comment "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Ovidentia FX "babInstallPath" File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:babInstallPath "(?:/\.\./|(?:http|https|ftp)\:/)" 

# Rule 310019: Siteframe "LOCAL_PATH" File Inclusion Vulnerability
SecRule SCRIPT_FILENAME "/siteframe\.php" chain
SecRule ARGS:LOCAL_PATH "(?:/\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: Siteframe "LOCAL_PATH" File Inclusion Vulnerability
SecRule REQUEST_URI "/siteframe\.php\?LOCAL_PATH=(?:http|https|ftp)\:/"

# Rule 310019:  e107 ePing Plugin Shell Command Injection Vulnerability
SecRule REQUEST_URI "/doping\.php" chain
SecRule ARGS:eping_cmd|ARGS:eping_host|ARGS:eping_count "(?:cd|\;|(?:ba|tc|c|z)sh|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(?:download|request|mirror|rget)|id|uname|cvs|svn|(?:s|r)(?:cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"

# Rule 310019:  Invision Community Blog Module SQL injection
SecRule REQUEST_URI "/index.php" chain
SecRule ARGS:mid "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019:  MWChat "CONFIG[MWCHAT_Libs]" File Inclusion Vulnerability
SecRule REQUEST_URI "CONFIG\[MWCHAT_Libs\]" chain
SecRule REQUEST_URI "(?:/\.\./|(?:http|https|ftp)\:/)"

# Rule 310019:  YaPiG Multiple Vulnerabilities
SecRule REQUEST_URI "last_gallery\.php" chain
SecRule ARGS:YAPIG_PATH "(?:/\.\./|(?:http|https|ftp)\:/)"

# Rule 310019:  YaPiG Multiple Vulnerabilities
SecRule ARGS:BASE_DIR "(?:/\.\./|(?:http|https|ftp)\:/)"

# Rule 310019:  YaPiG Multiple Vulnerabilities
SecRule REQUEST_URI "/upload\.php" chain
SecRule ARGS:dir "(?:/\.\./|.*\.\./)"

# Rule 310019: honeypot catch
SecRule REQUEST_URI "/write\.php\?dir=(?:http|https|ftp)\:/"

# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/article\.php\?sid=\x27"
# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/user\.php\?uname=\'"
# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/viewforum\.php\?forum=.*&siteid=\x2527"
# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/newtopic\.php\?username=\'&password="
# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/sections.php\?op=listarticles&secid=(?:\x27|\x2527)"
# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/index\.php\?siteid=\'&op=show&aftersid="
# Rule 310019: socialMPN Remote SQL Injection and Path Disclosure Vulnerabilities
SecRule REQUEST_URI "/friend\.php\?sid=\x2527&yname=.*&ymail=.*&fname=.*&fmail=.*&op=SendStory"

# Rule 310019: JBOSS Installation Path and Configuration File disclosure
SecRule REQUEST_URI|REQUEST_BODY "^\%\."
# Rule 310019: JBOSS Installation Path and Configuration File disclosure
SecRule REQUEST_URI|REQUEST_BODY "^\%server\.policy"

# Rule 310019: Mambo 'com_contents' Input Validation Hole in 'user_rating' SQL Injection 
SecRule REQUEST_URI "/index\.php\?option=com_content&task=vote&id=.*&Itemid=.*&cid=.*&user_rating=.*\(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+(?:from|into|table|database|index|view)"


# Rule 310019: Web Store remote command execution
SecRule REQUEST_URI "web_store\.cgi\?page=.*\|"

# Rule 310019: Mambo "user_rating" SQL Injection Vulnerability
SecRule REQUEST_URI "/content\.php" chain
SecRule ARGS:user_rating ".*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Cacti remote file inclusion vuln
SecRule REQUEST_URI "/(?:top_graph_header|config_settings)\.php\?.*=(?:http|https|ftp)\:/" 

# Rule 310019: Claroline E-Learning SQL injection
SecRule REQUEST_URI "/(?:userInfo|exercises_details)\.php\?(?:uInfo|exo_id)=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: Claroline E-Learning SQL injection
SecRule REQUEST_URI "\?uInfo=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+(?:from|into|table|database|index|view)"

# Rule 310019: Forum Russian Board 4.2 Full command execution vuln
SecRule REQUEST_URI|REQUEST_BODY "message=.*&form_h=.*&style_edit_ok=\xC8x\E7x\ECx\E5x\EDx\E8x\F2x\FC"

# Rule 310019: SMF Modify SQL Injection vuln
SecRule REQUEST_URI "/index\.php\?action=(?:login|profile).*msg=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: cpanel XSS vuln
SecRule REQUEST_URI|REQUEST_BODY "/login\?user=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Cacti command execution vuln
SecRule REQUEST_URI "\.php\?rrdtool=*(?:cd |\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(?:download|request|mirror|rget)|id|uname|cvs|svn|(?:s|r)(?:cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"
# Rule 310019: Cacti command execution vuln
SecRule REQUEST_URI "/graph_image\.php\?local_graph_id=.*\x0a"

# Rule 310019: honeypot
SecRule REQUEST_URI "/index\.php\?pagina=(?:http|https|ftp)\:/"

# Rule 310019: PHPNuke spam hole
SecRule REQUEST_URI "/modules\.php\?name=WebMail\&file=nlmail"

# Rule 310019: Community Link Pro "file" Shell Command Injection Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/login\.cgi\?username=.*command=.*do=.*password=.*file=\|"

# Rule 310019: Pavsta Auto Site "sitepath" File Inclusion Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "user_check\.php" chain
SecRule ARGS:sitepath "(?:(?:http|https|ftp)\:/|(?:/\.\./|.*\.\./))"

# Rule 310019: Comdevn eCommerce Form Handler Vulnerabilities
SecRule REQUEST_URI "/index\.php\?homeinclude=catalog&category_id=&parent_id=.*" chain
SecRule REQUEST_URI "<[[:space:]]*(?:href|script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome|a)[[:space:]]*>"

# Rule 310019: Plans "evt_id" SQL Injection Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "plans\.cgi" chain
SecRule ARGS:evt_id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Sukru Alatas Guestbook Exposure of User Credentials
SecRule REQUEST_URI|REQUEST_BODY "db/gbdb\.mdb"

# Rule 310019: CSV_DB / i_DB Arbitrary Command Execution Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "csv_db\.cgi" chain
SecRule ARGS:file "\|"

# Rule 310019: PHP-Fusion database backup file retrieval vuln
SecRule REQUEST_URI|REQUEST_BODY "/(?:fusion_admin|administration)/db_backups/"

# Rule 310019: PHP-Fusion XSS vuln
SecRule REQUEST_URI|REQUEST_BODY "/submit\.php?.*(?:news_body|article_description|article_body).*<[[:space:]]*(?:href|script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome|a)[[:space:]]*>"

# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/download\.php\" chain
SecRule ARGS:Number "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/calendar\.php\?Cat=.*&month=.*&year=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/calendar\.php\?Cat=&month=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view).*year=.*"
# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/modifypost\.phpCat=.*&Username=.*&Number=*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view).*&Board=UBB8"
# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/mailthread\.php\?Cat=.*&Board=.*&Number=*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/viewmessage\.php\?Cat=&message=*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: UBB.threads SQL Injection
SecRule REQUEST_URI|REQUEST_BODY "/(?:addfav\|notifymod|grabnext).php\?Cat=.*&Board=.*&main=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Xoops XML sql injection
SecRule REQUEST_URI "(?:xmlrpc|xmlrpc_.*)\.php" chain
SecRule REQUEST_BODY "<methodName>blogger\.getUsersBlogs</methodName>" chain
SecRule REQUEST_BODY ".*\' AND ascii\(substring\(pass"

# Rule 310019: Wordpress cat vuln
SecRule REQUEST_URI  "/wordpress/" chain
SecRule ARGS:cat "!^[0-9]*$"

# Rule 310019: Atomicboard path recursion
SecRule REQUEST_URI|REQUEST_BODY "/atomicboard/index\.php\?location=\.\./\."

# Rule 310019: basilix path recursion
SecRule REQUEST_URI|REQUEST_BODY "/basilix\.php3\?request_id\[.*\]=\.\./\."

# Rule 310019: bigconf path recursion vuln
SecRule REQUEST_URI|REQUEST_BODY "/bigconf\.cgi\?command=view_textfile&file=/"

# Rule 310019: a1disp3 path recursion vuln
SecRule REQUEST_URI "/a1disp3\.cgi\?/\.\./"

# Rule 310019: contacts remote file inclusion
SecRule REQUEST_URI "/contacts\.php\?cal_dir=(?:http|https|ftp)\:/"

# Rule 310019: CuteNews Search remote file inclusion
SecRule REQUEST_URI "/cutenews/search\.php\?cutepath=(?:http|https|ftp)\:/"

# Rule 310019: Dynamic Pages config remote file inclusion
SecRule REQUEST_URI "/config_page\.php\?do=.*&du=site&edp_relative_path=(?:http|https|ftp)\:/"

# Rule 310019: Edit_image file recursion vuln
SecRule REQUEST_URI "/edit_image\.php\?dn=.*&userfile=/"

# Rule 310019: export.php directory recursion vuln
SecRule REQUEST_URI "/export\.php\?\?what=\.\./\."

# Rule 310019: awol-condensed remote file inclusion
SecRule REQUEST_URI "/awol-condensed\.inc\.php\?path=(?:http|https|ftp)\:/"

# Rule 310019: config.php remote file inclusion
SecRule REQUEST_URI "/config\.php\?relative_script_path=(?:http|https|ftp)\:/"

# Rule 310019: hnmain remote file inclusion
SecRule REQUEST_URI "/hnmain\.inc\.php3\?config\[incdir\]=(?:http|https|ftp)\:/"

# Rule 310019: template remote file inclusion
SecRule REQUEST_URI "/index\.php\?board=.*;action=.*;ext=.*;template=(?:http|https|ftp)\:/"

# Rule 310019: generic remote file inclusion vulns
SecRule REQUEST_URI "/index\.php\?do=.*&page=(?:http|https|ftp)\:/"
# Rule 310019: generic remote file inclusion vulns
SecRule REQUEST_URI "/index\.php\?kietu\[.*\]=(?:http|https|ftp)\:/"
# Rule 310019: generic remote file inclusion vulns
SecRule REQUEST_URI "/index\.php\?libDir=http://xxxxxxxx"
# Rule 310019: generic remote file inclusion vulns
SecRule REQUEST_URI "/init\.php\?HTTP_POST_VARS\[GALLERY_BASEDIR\]=(?:http|https|ftp)\:/"

# Rule 310019: Cacti no_http_headers security vuln
SecRule REQUEST_URI "/config\.php\?" chain
SecRule ARGS:no_http_headers ".*"

# Rule 310019: Quick & Dirty PHPSource Printer Directory Traversal Vulnerability
SecRule REQUEST_URI "/source\.php\?" chain
SecRule ARGS:file "\.\."

# Rule 310019: nabopoll "path" File Inclusion Vulnerability
SecRule REQUEST_URI "/survey\.inc\.php\?" chain
SecRule ARGS:path "(?:\.\.|(?:http|https|ftp)\:/)"
# Rule 310019: nabopoll "path" File Inclusion Vulnerability
SecRule REQUEST_URI "/survey\.inc\.php\?path=(?:http|https|ftp)\:/"

# Rule 310019: DCP-Portal remote file include
SecRule REQUEST_URI "/editor/editor\.php\?root=(?:http|https|ftp)\:/"

# Rule 310019: phpBB remote code execution vuln
SecRule REQUEST_URI "/viewtopic\.php\?.*(?:highlight.*(?:\'\.|\x2527|\x27)|include\(?:.*GET\[.*\]\)|=(?:http|https|ftp)\:/|(?:printf|system)\()"

# Rule 310019: Unknown Malware
SecRule REQUEST_URI "/mcp/mcp\.cgi"

# Rule 310019:  osTicket "t" SQL Injection Vulnerability
SecRule REQUEST_URI "/view\.php" chain
SecRule ARGS:t "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Mark Kronsbein MyGuestbook "lang" File Inclusion Vulnerability
SecRule REQUEST_URI "/form\.inc\.php3" chain
SecRule ARGS:lang "(?:\.\.|(?:http|https|ftp)\:/)"

# Rule 310019: phpPgAdmin "formLanguage" Local File Inclusion Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/index\.php" chain
SecRule ARGS:formLanguage "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: PPA Include File Bug remote file inclusion
SecRule REQUEST_URI|REQUEST_BODY "/functions\.inc\.php\?config\[ppa_root_path\]=(?:http|https|ftp)\:/"

# Rule 310019: SPiD Include File Bug remote file inclusion
SecRule REQUEST_URI|REQUEST_BODY "/lang/lang\.php\" chain
SecRule ARGS:lang_path "(?:http|https|ftp)\:/"

# Rule 310019: Id Board 'tbl_suff' Input Validation Hole SQL injection
SecRule REQUEST_URI|REQUEST_BODY "/index\.php\?site=.*&f=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: DownloadProtect "file" Disclosure of Sensitive Information
SecRule REQUEST_URI|REQUEST_BODY "/download\.php\?" chain
SecRule ARGS:file "\.\./"

# Rule 310019: phpSecurePages "cfgProgDir" File Inclusion Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "phpSecurePages/secure\.php" \
"chain,t:urlDecodeUni,t:lowercase,id:310019,rev:1, severity:2,msg:'JITP: phpSecurePages cfgProgDir File Inclusion Vulnerability'"
SecRule ARGS:cfgProgDir "(?:\.\./|(?:gopher|ogg|zlib|(?:ht|f)tps?\:/))"

# Rule 310019: PunBB SQL Injection and PHP Code Execution Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "/profile\.php" chain
SecRule ARGS:temp "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: PunBB SQL Injection and PHP Code Execution Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "redirect_url.*(?:http|https|ftp)\:/.*cmd="

# Rule 310019:  pngcntrp "kaiseki.cgi" Shell Command Injection Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "/kaiseki\.cgi.*\|"

# Rule 310019:  phpWebSite SQL Injection and Disclosure of Sensitive Information
SecRule REQUEST_URI|REQUEST_BODY "index\.php" chain
SecRule ARGS:mod|ARGS:module "(?:\.\./|(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view))"

# Rule 310019:  Simple PHP Blog Exposure of User Credentials
SecRule REQUEST_URI|REQUEST_BODY "config/password\.txt"

# Rule 310019:  Squito Gallery "photoroot" File Inclusion Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "photolist\.inc\.php" chain
SecRule ARGS:photoroot "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019:  iPhotoAlbum File Inclusion Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "/getpage\.php" chain
SecRule ARGS:docpath|ARGS:path "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019:  iPhotoAlbum File Inclusion Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "header\.php" chain
SecRule ARGS:set_menu "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: Yawp "_Yawp[conf_path]" File Inclusion Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "_Yawp\[conf_path\]=(?:(?:\.\./|(?:http|https|ftp)\:/)|.*(?:\.\./|(?:http|https|ftp)\:/))"

# Rule 310019: Phpauction GPL Multiple Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:lan "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: Phpauction GPL Multiple Vulnerabilities
SecRule REQUEST_URI "/adsearch\.php" chain
SecRule ARGS:category "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: USANet Creations Products Shell Command Injection Vulnerability
SecRule REQUEST_URI "/dispallclosed\.pl.*\|"

# Rule 310019: Web-Portal-System 'wps_shop.cgi' Remote Command Execution 
SecRule REQUEST_URI "/wps_shop\.cgi" chain
SecRule ARGS:art|ARGS:cat "(?:\[|\;|\<|\>|\*|\||\'|\&|\$|\!|\?|\#|\(|\)|\[|\]|\{|\}|\:|\'|\"|\])"

# Rule 310019: Web-Portal-System 'wps_shop.cgi' Remote Command Execution 
SecRule REQUEST_URI "/wps_shop\.cgi" chain
SecRule ARGS:art "\|.+\|"

# Rule 310019: class-1 Forum Software SQL Injection
SecRule REQUEST_URI "/viewattach\.php" chain
SecRule ARGS:id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: class-1 Forum Software SQL Injection
SecRule REQUEST_URI "/users\.php" chain
SecRule ARGS:viewuser_id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: class-1 Forum Software SQL Injection
SecRule REQUEST_URI "/viewforum\.php" chain
SecRule ARGS:forum "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: MooseGallery "type" File Inclusion Vulnerability
SecRule REQUEST_URI "/display\.php" chain
SecRule ARGS:type "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: honetpot catch
SecRule REQUEST_URI "\x03\x03\x03\x03\x18\x18\x18\x18\x1a\x1c\x1a\x1c\x1c4r43tr"

# Rule 310019: CaLogic "CLPATH" Arbitrary File Inclusion Vulnerability
SecRule REQUEST_URI "(?:clmcpreload|mcconfig)\.php" chain
SecRule ARGS:CLPATH "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: OpenBB sql injection 
SecRule REQUEST_URI "/index\.php\?CID=.*\+union\+select\+.*\,.*\,password.*from\+profiles\+where"

# Rule 310019: ReviewPost PHP Pro "sort" SQL Injection Vulnerability
SecRule REQUEST_URI "/showproduct\.php" chain
SecRule ARGS:sort "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: PHPNews "user" and "password" SQL Injection Vulnerability
SecRule REQUEST_URI "/auth\.php" chain
SecRule ARGS:user|ARGS:password "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: PHP Surveyor Remote SQL Injection
SecRule REQUEST_URI "/admin/" chain
SecRule ARGS:sid|ARGS:start|ARGS:id|ARGS:lid "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Invision PowerBoard 1.3.x - 2.0 SQL injection
SecRule REQUEST_URI "/index\.php\?act=Login&CODE=autologin.*(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|user\+AND\+MID\(password)"

# Rule 310019: sendcard "id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/sendcard\.php" chain
SecRule ARGS:id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Report from user
SecRule REQUEST_URI "/functions_admin\.php\?phpbb_root_path=(?:http|https|ftp)\:/"

# Rule 310019: SQL injection vuln in Contrexx
SecRule REQUEST_URI "/index\.php\?section=gallery&cmd=.*&cid*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: PHP FirstPost remote file include
SecRule REQUEST_URI "/block\.php\?Include=(?:http|https|ftp)\:/"

# Rule 310019: DCForum remote file viewing
SecRule REQUEST_URI "/dcforum\.cgi\?az=.*&forum=*\.\./\.\."

# Rule 310019: Atomic Photo Album "apa_module_basedir" File Inclusion
SecRule REQUEST_URI "/apa_phpinclude\.inc\.php" chain
SecRule ARGS:apa_module_basedir "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: VBZooM "SubjectID" SQL Injection Vulnerability
SecRule REQUEST_URI "/show\.php" chain
SecRule ARGS:SubjectID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Phorm remote file inclusion protections
SecRule REQUEST_URI "/phorm\.php" chain
SecRule ARGS:PHORM_* "(?:http|https|ftp)\:/"

# Rule 310019: Athena Web Registration Remote Command Execution Vuln
SecRule REQUEST_URI "/athenareg\.php\?pass=\x20\;"

# Rule 310019: wowBB view_user.php SQL Injection
SecRule REQUEST_URI "/wowbb/view_user\.php\?" chain
SecRule REQUEST_URI|REQUEST_BODY "sort_by=\'" chain
SecRule REQUEST_URI|REQUEST_BODY "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Simplicity oF Upload remote command exec and remote file inclusion
SecRule REQUEST_URI "/download\.php\?language=(?:upload\.php|(?:http|https|ftp)\:/)"

# Rule 310019: uguestbook exploit
SecRule REQUEST_URI "/mdb-database/guestbook\.mdb"

# Rule 310019: FtpLocate remote command execution
SecRule REQUEST_URI "/flsearch\.pl" chain
SecRule ARGS:query "\|"

# Rule 310019: PHPmyGallery "confdir" File Inclusion Vulnerability
SecRule REQUEST_URI "/common-tpl-vars\.php" chain
SecRule ARGS:confdir "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: Netquery 3.1 Remote Command Execution vuln
SecRule REQUEST_BODY "op=modload*&name=Net.*&file=*&query=ping&host=*\|"

# Rule 310019: MySQL Eventum SQL Injection Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "/includes/class\.auth\.php" chain
SecRule ARGS:email "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Kayako LiveResponse SQL injection
SecRule REQUEST_URI|REQUEST_BODY "/index\.php\?date=.*\x20.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: PHPlist SQL injection
SecRule REQUEST_URI|REQUEST_BODY "lists/admin/\?page=admin&id=*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/(?:PersonView|MemberRoleChange|PropertyAssign|WhyCameEditor|GroupPropsEditor|Reports/PDFLabel|UserDelete)\.php" chain
SecRule ARGS:PersonID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/DepositSlipEditor\.php" chain
SecRule ARGS:DepositSlipID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/QueryView\.php" chain
SecRule ARGS:QueryID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/(?:GroupView|GroupMemberList|MemberRoleChange|GroupDelete|/Reports/ClassAttendance|/Reports/GroupReport)\.php" chain
SecRule ARGS:GroupID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/PropertyEditor\.php" chain
SecRule ARGS:PropertyID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/PledgeDetails\.php" chain
SecRule ARGS:PledgeID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ChurchInfo SQL injection vulns
SecRule REQUEST_URI|REQUEST_BODY "/(?:AutoPaymentEditor|Canvas05Editor|CanvassEditor)\.php" chain
SecRule ARGS:FamilyID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: denial of service attack on Flex PHPNews 0.0.4
SecRule REQUEST_URI "/news\.php" chain
SecRule ARGS:prenumber|ARGS:nextnumber "[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]+"

# Rule 310019: SQL admin bypass for Flex PHPNews 0.0.4
SecRule REQUEST_URI "/admin/" chain
SecRule REQUEST_URI "\' OR \'a\'='a*\' OR \'a\'=\'a"

# Rule 310019: Naxtor Shopping Cart SQL Injection
SecRule REQUEST_URI  "/(?:lost_passowrd|lost_password)\.php" chain
SecRule ARGS:email "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Naxtor Shopping Cart SQL Injection
SecRule REQUEST_URI  "/shop_display_products\.php\?cat_id=\'"

# Rule 310019: OpenBook "admin.php" Remote SQL Injection Vulnerability
SecRule REQUEST_URI  "/admin\.php" chain
SecRule ARGS:userid "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|no\'\) or [0-9]/\*)"

# Rule 310019: OpenBook "admin.php" Remote SQL Injection Vulnerability
SecRule REQUEST_URI  "/admin\.php" chain
SecRule ARGS:password "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|no\'\) or [0-9]/\*)"

# Rule 310019: 'web content management'Add admin user bypass vuln
SecRule REQUEST_URI  "/Admin/Users/AddModifyInput\.php"

# Rule 310019: Silvernews 2.0.3 command injection backdoor
SecRule REQUEST_URI "/templates/tpl_global\.php\?command="
# Rule 310019: Silvernews 2.0.3 command injection backdoor
SecRule REQUEST_URI "/templates/tpl_global\.php\?"

# Rule 310019: PortailPHP Index.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php\?affiche=Forum-read_mess&id=\'"

# Rule 310019: python namespace exposure with karrigell services
SecRule REQUEST_URI|REQUEST_BODY ".*\.ks/.*\?\x22"
# Rule 310019: python namespace exposure with karrigell services
SecRule REQUEST_URI|REQUEST_BODY ".*\.ks/(?:file|input|open|raw_input|reload|(?:(?:s|g)et|del|has)attr|import|callable|compile|execfile|exec|globals)"

# Rule 310019: Flatnuke remote command vuln
SecRule REQUEST_URI "/forum/users/.*\.php\?command="

# Rule 310019: Forum Russian Board (FRB) SQL injection vulns
SecRule REQUEST_URI "/reply_in.php?subject_reply=.*&name_reply=.*\'"

# Rule 310019: Forum Russian Board (FRB) SQL injection vulns
SecRule REQUEST_URI "(?:search_msg_us|view_profile.php)\.php" chain
SecRule ARGS:id "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|\')"

# Rule 310019: Forum Russian Board (FRB) SQL injection vulns
SecRule REQUEST_URI "/send_mail_user\.php" chain
SecRule ARGS:id_mail "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|\')"

# Rule 310019: Forum Russian Board (FRB) SQL injection vulns
SecRule REQUEST_URI "/(?:set|new|reply)\.php" chain
SecRule ARGS:name_ig_array "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|\')"

# Rule 310019: Forum Russian Board (FRB) SQL injection vulns
SecRule REQUEST_URI "/menu_header\.php" chain
SecRule ARGS:table_sql "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|\')"

# Rule 310019: Forum Russian Board (FRB) SQL injection vulns
SecRule REQUEST_URI "/registr_1\.php" chain
SecRule ARGS:telephone "(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)|\')"

# Rule 310019: Owl Intranet Engine SQL injection
SecRule REQUEST_URI "/browse\.php\?sess=.*parent=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: PHP-Fusion Messages.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/messages\.php\?msg_view=\'"

# Rule 310019: MySQL Eventum SQL injection
SecRule REQUEST_URI "/login\.php" chain
SecRule REQUEST_URI "cat=login&url=&email=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: phpIncludes News System SQL Injection Vulnerability
SecRule REQUEST_URI "/news_change_category\.php" chain
SecRule ARGS:category "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Comdev eCommerce File Inclusion Vulnerability
SecRule REQUEST_URI "/config\.php\?path\[docroot\]=(?:(?:\.\./|(?:http|https|ftp)\:/)|.*(?:\.\./|(?:http|https|ftp)\:/))"

# Rule 310019: honeypot
SecRule REQUEST_URI "/write.php" chain
SecRule ARGS:dir "(?:http|https|ftp)\:/"

# Rule 310019: Gravity Board X SQL injection vuln
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:email "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Gravity Board X command injection vulnerability
SecRule REQUEST_URI "/editcss\.php\?" chain
SecRule ARGS:csscontent "\</style\>\<\?php"

# Rule 310019: Open Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(?:board|read|member)\.php" chain
SecRule ARGS:FID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Open Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(?:board|read|member)\.php" chain
SecRule ARGS:TID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Open Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(?:board|read|member)\.php" chain
SecRule ARGS:UID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: XMB Forum 1.9.1 sql injection
SecRule REQUEST_URI "/xmb\.php" chain
SecRule ARGS:in "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Funkboard command injection vuln
SecRule REQUEST_URI "/info\.php\?command="

# Rule 310019: honeypot catch
SecRule REQUEST_URI "/forum/users/jimyhendrix\.php\?command="

# Rule 310019: XMB Forum sql injection
SecRule REQUEST_URI "include/u2u\.inc\.php" chain
SecRule ARGS:u2u_select "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: WordPress "cache_lastpostdate" PHP Code Insertion
SecRule ARGS:cache_lastpostdate "<\?php"

# Rule 310019: honeypot
SecRule REQUEST_URI "/lib\.php\" chain
SecRule ARGS:root "(?:http|https|ftp)\:/"

# Rule 310019: PHPTB Topic Boards 2.0  sql injection vulnerability
SecRule REQUEST_URI "/index\.php\?act=emailvalidate&mid=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: FreznoShop product_details.php id Variable SQL Injection
SecRule REQUEST_URI "/product_details\.php" chain
SecRule ARGS:id "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: ECW Shop SQL injection
SecRule REQUEST_URI "/index\.php\?c=.*&ctg=.*&id=.*&key=.*&comp=.*&min.*\'"

# Rule 310019: Mig Remote Cross-Site Scripting vuln
SecRule REQUEST_URI "/index\.php\?currDir=.*[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: ezupload remote file inclusion vuln
SecRule REQUEST_URI "(?:customize|initialize|form|index)\.php\?path=(?:http|https|ftp)\:/"

# Rule 310019: Dokeos Multiple Directory Traversal Vulnerabilities
SecRule REQUEST_URI "/scorm/scormdocument\.php" chain
SecRule REQUEST_URI "\.\."
# Rule 310019: Dokeos Multiple Directory Traversal Vulnerabilities
SecRule REQUEST_URI "/claroline/document/document\.php" chain
SecRule ARGS:move_file "\.\."
SecRule REQUEST_URI "/claroline/document/document\.php" chain
SecRule ARGS:move_to "\.\."

# Rule 310019: PHPOpenChat Script Insertion Vulnerabilities
SecRule REQUEST_URI "/(?:profile|profile_misc|mail)\.php" chain
SecRule ARGS:title|ARGS:content|ARGS:motto|ARGS:subject "[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019:  FunkBoard mysql_install.php Email Field Arbitrary PHP Code Injection
SecRule REQUEST_URI "/mysql_install\.php" chain
SecRule ARGS:Email "\<.*php"

# Rule 310019: phpPgAds SQL injection
SecRule REQUEST_URI "/lib-view-direct\.inc\.php" chain
SecRule ARGS:clientid "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Honeypot catch
SecRule REQUEST_URI "/guest\.php\?page=(?:http|https|ftp)\:/"

# Rule 310019: PHPTB "absolutepath" Arbitrary File Inclusion Vulnerability
SecRule REQUEST_URI ".*\.php\?absolutepath=(?:http|https|ftp)\:/"

# Rule 310019: PHPFreeNews SQL Injection and Cross-Site Scripting
SecRule REQUEST_URI "/SearchResults\.php" chain
SecRule ARGS:Match|ARGS:CatID "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: w-Agora "site" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php\?site=.*\x00"

# Rule 310019: Zorum prod.php Arbitrary Command Execution Vulnerability
SecRule REQUEST_URI "/prod\.php\?argv\[.*\]=\|"

# Rule 310019: Zorum path disclosure
SecRule REQUEST_URI "/gorum/(?:notification|trace|badwords|flood)\.php"
# Rule 310019: Zorum path disclosure
SecRule REQUEST_URI "/zorum/(?:user|attach|blacklist|forum|globalstat)\.php"

# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/forums\.php\?m=topics&s=\'"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/list\.php\?c=.*&s=.*&.*\'"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/list\.php\?c=.*&s=\'"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/links\.php\?c=.*&s=.*&w=\'"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/journal\.php?m=.*\'"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/forums\.php?filter=forums.*x='"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/forums\.php?m=.*\'"
# Rule 310019: Land Down Under SQL injection vulns
SecRule REQUEST_URI "/forums\.php?m=\'"

# Rule 310019: Woltlab Burning Board ModCP.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/modcp\.php\?action=post_del&x=\'"
# Rule 310019: Woltlab Burning Board ModCP.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/modcp\.php\?action=post_del&x.*\'"

# Rule 310019: Cacti graph_image.php Remote Command Execution
SecRule REQUEST_URI "/graph_image\.php" chain
SecRule ARGS:graph_start "x0a.+x0a"

# Rule 310019: AreaEdit SpellChecker Plugin Code Execution Vulnerability
SecRule REQUEST_URI "/aspell_setup\.php" chain
SecRule ARGS:dictionary "(?:\;|\|)"

# Rule 310019: WebCalendar "includedir" Arbitrary File Inclusion Vulnerability
SecRule REQUEST_URI "/send_reminders\.php" chain
SecRule ARGS:includedir "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: PHPKit SQL Injection Vulnerabilities
SecRule REQUEST_URI "login/imcenter\.php" chain
SecRule ARGS:im_receiver "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: PHPKit SQL Injection Vulnerabilities
SecRule REQUEST_URI "login/member\.php" chain
SecRule ARGS:letter "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019: Netquery "host" Parameter Arbitrary Command Execution
SecRule REQUEST_URI "/nquser\.php" chain
SecRule ARGS:host "\|"

# Rule 310019: SaveWebPortal include PHP scripts vuln
SecRule REQUEST_URI "admin/PhpMyExplorer/editerfichier\.php\?chemin=\.&fichier=header\.php&type=Source"

# Rule 310019: SaveWebPortal remote/local file inclusion vuln
SecRule REQUEST_URI "menu_dx\.php" chain
SecRule ARGS:SITE_Path "(?:\.\./|(?:http|https|ftp)\:/)"
# Rule 310019: SaveWebPortal remote/local file inclusion vuln
SecRule REQUEST_URI "menu_sx\.php" chain
SecRule ARGS:CONTENTS_Dir "(?:\.\./|(?:http|https|ftp)\:/)"

# Rule 310019: RunCMS SQL Injection Vulnerabilities
SecRule REQUEST_URI "newbb_plus/newtopic\.php\?forum=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"
# Rule 310019: RunCMS SQL Injection Vulnerabilities
SecRule REQUEST_URI "newbb_plus/print\.php\?msgid=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view).*&op="
# Rule 310019: RunCMS SQL Injection Vulnerabilities
SecRule REQUEST_URI "newbb_plus/(?:edit|reply)\.php\?forum=.*(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view).*post_id=.*&topic_id=.*&viewmode=.*&order=.*"

# Rule 310019: honeypot catch
SecRule REQUEST_URI "/index\.php\?page=(?:http|https|ftp)\:/"

# Rule 310019: PostNuke "show" Parameter SQL Injection Vulnerability
SecRule REQUEST_URI "modules/Downloads/dl-viewdownload\.php" chain
SecRule ARGS:show "(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](?:from|into|table|database|index|view)"

# Rule 310019:  PaFileDB cookie SQL injection
SecRule REQUEST_URI "/pafiledb\.php\?action=admin" chain
SecRule REQUEST_COOKIES:pafiledbcookie ".*(?:(?:select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)|union.*select.*[0-9]+\,[0-9]+\,\'.*pass)"

# Rule 310019: Looking Glass v20040427 arbitrary commands execution
SecRule REQUEST_URI "/lg\.php" chain
SecRule REQUEST_URI "func=.*&ipv=.*&target.*\|"
# Rule 310019: Looking Glass v20040427 arbitrary commands execution
SecRule REQUEST_URI "/lg\.php" chain
SecRule ARGS:target "\|"

# Rule 310019: probe.cgi remote file inclusion and command execution
SecRule REQUEST_URI "/probe\.cgi\?olddat=(?:\||(?:http|https|ftp)\:/)"

# Rule 310019:  phpMyAdmin XSS vulns
SecRule REQUEST_URI "libraries/auth/cookie\.auth\.lib\.php" chain
SecRule REQUEST_URI "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019:  phpMyAdmin XSS vulns
SecRule REQUEST_URI "/error\.php" chain
SecRule ARGS:error "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Looking Glass v20040427 XSS vulns
SecRule REQUEST_URI "/(?:footer|header)\.php\?version\[.*\]=" chain
SecRule REQUEST_URI "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpLDAPadmin welcome.php Arbitrary File Inclusion
SecRule REQUEST_URI "/welcome\.php\?custom_welcome_page=(?:http|https|ftp)\:/"

# Rule 310019: Simple PHP Blog comment_delete_cgi.php Arbitrary File Deletion
SecRule REQUEST_URI "/comment_delete_cgi\.php" chain
SecRule ARGS:comment "(?:/|\.\.|config/password\.txt)"

# Rule 310019: nested URL tags exploit for some BBcode implementations
SecRule REQUEST_URI ".*\.php" chain
SecRule REQUEST_BODY|ARGS "\[url=\[url="

# Rule 310019: AutoLinks Pro "alpath" File Inclusion Vulnerability
SecRule REQUEST_URI "/al_initialize\.php" chain
SecRule ARGS:alpath "(?:ftp|http|https)\:/"

# Rule 310019: Simple PHP Blog Image File Upload Vulnerability
SecRule REQUEST_URI "/upload_img_cgi\.php" chain
SecRule REQUEST_BODY|ARGS "\.php"

# Rule 310019: phpWebNotes Include File Error in 'php_api.php'
SecRule REQUEST_URI "/api\.php\?t_path_core=(?:http|https|ftp)\:/"

# Rule 310019: FlatNuke "id" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:id "(?:http|https|.ftp)\:/"

# Rule 310019: CMS Made Simple File Inclusion
SecRule REQUEST_URI "admin/lang\.php.*nls\[file\]\[vx\]\[vxsfx\].*(?:http|https|.ftp)\:/"

# Rule 310019: Phorum "Username" Script Insertion Vulnerability
SecRule REQUEST_URI "register\.php" chain
SecRule ARGS:Username "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Test CGI probe
SecRule REQUEST_URI|REQUEST_BODY "/test-cgi HTTP\/(?:0\.9|1\.0|1\.1)$"

# Rule 310019: Annoying Cisco IOS HTTP configuration probe attempts
SecRule REQUEST_URI "/level/[0-9]+/exec/-/+pwd"

# Rule 310019: myBloggie "username" SQL Injection Vulnerability
SecRule REQUEST_URI "/login\.php" chain
SecRule ARGS:username "[[:space:]]+(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: PBLang <= 4.65 remote commands exec exploit sig
SecRule REQUEST_URI|REQUEST_BODY "Content-Length:.*user=.*pass=.*pass2=.*oldpass=.*loc.*(?:\x22|system)"

# Rule 310019: man2web cgi-scripts remote command spawn
SecRule REQUEST_URI "/(?:man-cgi|man2web|man2html)" chain
SecRule REQUEST_URI "\x20"
# Rule 310019: man2web cgi-scripts remote command spawn
SecRule REQUEST_URI "/(?:man-cgi|man2web|man2html)" chain
SecRule REQUEST_URI "\|"

# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI "/comment_delete_cgi\.php\?y=.*&m=.*&comment.*(?:/|\.\.)"
# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI "/comment_delete_cgi\.php\?.*/config/password\.txt"
# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI "/images/reset\.php"
# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI "/images/cmd\.php\?cmd="
# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI "/upload_img_cgi.php" chain
SecRule REQUEST_BODY "(?:Content.*\.php|cmd\.php|reset\.php)"
# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI "/install03_cgi\.php\?blog_language=english.*[A-Z|a-z|0-9]"
# Rule 310019: SimplePHPBplog vulns
SecRule REQUEST_URI|REQUEST_BODY "<hr+><pre>.*Command\: [A-Z|a-z|0-9|\w].*pre><hr"

# Rule 310019:  aMember Pro "config['root_dir']" Remote File Inclusion Vulnerabilities
SecRule REQUEST_URI "(?:/db/mysql/mysql|payment|/efsnet/efsnet|theinternetcommerce/theinternetcommerce|/cdg/cdg|compuworld/compuworld|directone/directone|authorize_aim/authorize_aim|beanstream/beanstream|echo/config|/eprocessingnetwork/eprocessingnetwork|eway/eway|linkpoint/linkpoint|logiccommerce/logiccommerce|netbilling/netbilling|payflow_pro/payflow_pro|paymentsgateway/paymentsgateway|payos/payos|payready/payready|plugnplay/plugnplay)\.inc\.php\?config\[root_dir\]=(?:http|https|ftp):/"
# Rule 310019:  aMember Pro "config['root_dir']" Remote File Inclusion Vulnerabilities
SecRule REQUEST_URI "(?:/db/mysql/mysql|payment|/efsnet/efsnet|theinternetcommerce/theinternetcommerce|/cdg/cdg|compuworld/compuworld|directone/directone|authorize_aim/authorize_aim|beanstream/beanstream|echo/config|/eprocessingnetwork/eprocessingnetwork|eway/eway|linkpoint/linkpoint|logiccommerce/logiccommerce|netbilling/netbilling|payflow_pro/payflow_pro|paymentsgateway/paymentsgateway|payos/payos|payready/payready|plugnplay/plugnplay)\.inc\.php" chain
SecRule REQUEST_URI "(?:http|https|ftp):/"
# Rule 310019:  aMember Pro "config['root_dir']" Remote File Inclusion Vulnerabilities
SecRule REQUEST_URI "\.inc\.php\?config\[root_dir\]=(?:http|https|ftp):/"

# Rule 310019: CuteNews Input Validation Hole
SecRule REQUEST_URI "/cute/data/flood\.db\.php" 

# Rule 310019: DeluxeBB SQL injection
SecRule REQUEST_URI "community/index\.php\?limit=\'"


# Rule 310019: honeypoit
SecRule REQUEST_URI "/admin_module_deldir\.php\?config\[.*\]=(?:http|https|ftp)\:/"

# Rule 310019: honeypot catch
SecRule REQUEST_URI "/view\.php\?inc=(?:http|https|ftp)\:/"

# Rule 310019: Alkalay contribute "template" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/contribute\.pl" chain
SecRule ARGS:template "\|"
# Rule 310019: Alkalay contribute "template" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/contribute\.pl.*\|"

# Rule 310019: Alkalay man-cgi "topic" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/man-cgi\.cgi"
# Rule 310019: Alkalay man-cgi "topic" Shell Command Injection Vulnerability
SecRule ARGS:topic "\|"
# Rule 310019: Alkalay man-cgi "topic" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/man-cgi\.cgi.*\|"

# Rule 310019: Alkalay notify "from" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/notify\.cgi" chain
SecRule ARGS:from  "\|"
# Rule 310019: Alkalay notify "from" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/notify\.cgi.*\|"

# Rule 310019: Alkalay nslookup Shell Command Injection Vulnerabilities
SecRule REQUEST_URI "/nslookup\.cgi" chain
SecRule ARGS:type|ARGS:queryARGS:ns "\|" 

# Rule 310019: Alkalay nslookup Shell Command Injection Vulnerabilities
SecRule REQUEST_URI "/nslookup\.cgi.*\|"

# Rule 310019: Simplog SQL Injection Vulnerabilities
SecRule REQUEST_URI "/archive\.php" chain
SecRule ARGS:pid|ARGS:blogid|ARGS:cid|ARGS:m "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: Simplog SQL Injection Vulnerabilities
SecRule REQUEST_URI "/blogadmin\.php"  chain
SecRule ARGS:blogid "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/joinrequests\.php" chain
SecRule REQUEST_URI "do=processjoinrequests&usergroupid=.*&request.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/admincp/user\.php" chain
SecRule REQUEST_URI "do=find&orderby=username&limit.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/admincp/(?:usertitle|usertools)\.php" chain
SecRule REQUEST_URI "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/modcp/announcement\.php" chain
SecRule REQUEST_URI "do=update&announcementid=.*&start=.*&end=.*&announcement.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/admincp/admincalendar\.php" chain
SecRule REQUEST_URI "do=update&calendarid=.*&calendar\[.*\]=.*&calendar.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/admincp/email\.php" chain
SecRule REQUEST_URI "do=makelist&user\[.*\].*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/admincp/help\.php" chain
SecRule REQUEST_URI "do=doedit&help\[.*\]=.*&help\[.*\].*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "admincp/language\.php" chain
SecRule REQUEST_URI "do=update&rvt\[.*\].*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: vbulletin vulnerabilities, SQL injection
SecRule REQUEST_URI "/admincp/phrase\.php" chain
SecRule REQUEST_URI "do=completeorphans&keep\[.*\].*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: PHP Advanced Transfer Manager Multiple Vulnerabilities
SecRule REQUEST_URI "/(?:txt|htm|html|zip)\.php" chain
SecRule ARGS:current_dir|ARGS:filename "\.\." 

# Rule 310019: PHP Advanced Transfer Manager Multiple Vulnerabilities
SecRule REQUEST_URI "/txt\.php" chain
SecRule ARGS:font|ARGS:normalfontcolor|ARGS:mess\[31\] "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpCommunityCalendar SQJ injection Vulnerabilities
SecRule REQUEST_URI "/webadmin/login\.php" chain
SecRule ARGS:Username "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: phpCommunityCalendar SQJ injection Vulnerabilities
SecRule REQUEST_URI "/week\.php" chain
SecRule ARGS:LocationID "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: MyBulletinBoard SQL Injection Vulnerabilities
SecRule REQUEST_URI "/misc\.php" chain
SecRule ARGS:fid "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: MyBulletinBoard SQL Injection Vulnerabilities
SecRule REQUEST_URI "/newreply\.php" chain
SecRule ARGS:icon "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]" 

# Rule 310019: WEB//NEWS SQL Injection Vulnerabilities
SecRule REQUEST_URI "/modules/startup\.php" chain
SecRule ARGS:wn_userpw "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: WEB//NEWS SQL Injection Vulnerabilities
SecRule REQUEST_URI "include_this/news\.php" chain
SecRule ARGS:cat|ARGS:id|ARGS:stof "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: WEB//NEWS SQL Injection Vulnerabilities
SecRule REQUEST_URI "/print\.php" chain
SecRule ARGS:id "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: PBLang Local File Inclusion and PHP Code Injection
SecRule REQUEST_URI "/setcookie.php" chain
SecRule ARGS:u "\.\."

# Rule 310019: PBLang Local File Inclusion and PHP Code Injection
SecRule REQUEST_URI "/ucp\.php" chain
SecRule REQUEST_URI "\""

# Rule 310019: mimicboard2 Exposure of User Credentials
SecRule REQUEST_URI "/mimic2\.dat"

# Rule 310019: Mall23 eCommerce "idPage" SQL Injection Vulnerability
SecRule ARGS:idPage "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: PHP-Nuke SQL Injection Vulnerabilities
SecRule REQUEST_URI "/modules\.php" chain
SecRule ARGS:name|ARGS:sid|ARGS:pid "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]" 

# Rule 310019: Subscribe Me Pro "l" Parameter Directory Traversal Vulnerability
SecRule REQUEST_URI "/s\.pl" chain
SecRule ARGS:l "\.\."

# Rule 310019: TWiki "rev" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/TWikiUsers" chain
SecRule ARGS:rev "![0-9]+"

# Rule 310019: TWiki "rev" Shell Command Injection Vulnerability
SecRule REQUEST_URI "/TWikiUsers\?rev=.*(?:\'|\|)"

# Rule 310019: DeluxeBB SQL Injection Vulnerabilities
SecRule REQUEST_URI "/topic\.php\?tid.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: DeluxeBB SQL Injection Vulnerabilities
SecRule REQUEST_URI "/misc\.php\?sub=profile&uid.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: DeluxeBB SQL Injection Vulnerabilities
SecRule REQUEST_URI "/forums\.php\?fid=.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: DeluxeBB SQL Injection Vulnerabilities
SecRule REQUEST_URI "/pm\.php\?sub=newpm&uid=.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: DeluxeBB SQL Injection Vulnerabilities
SecRule REQUEST_URI "/newpost\.php\]?sub=newthread&fid=.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019:  Noah's Classified SQL Injection and Cross-Site Scripting
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:rollid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>)"

# Rule 310019:  AzDGDatingLite "l" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/include/security\.inc\.php" chain
SecRule ARGS:l "(?:\.\.|/)"

# Rule 310019:  ATutor Password Reminder SQL Injection Vulnerability
SecRule REQUEST_URI "/password_reminder\.php" chain
SecRule REQUEST_URI "email.*(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019:  ATutor Password Reminder SQL Injection Vulnerability
SecRule REQUEST_URI "/password_reminder\.php.*form_email=.+UNION\s+SELECT"

# Rule 310019: Digital Scribe "username" SQL Injection
SecRule REQUEST_URI "/login\.php" chain
SecRule ARGS:username "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: aeDating "Country[]" SQL Injection Vulnerability
SecRule REQUEST_URI "/search_result.php" chain
SecRule ARGS:Country\[\] "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: NooToplist "o" SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:o "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: HTTP header PHP code injection attacks
SecRule REQUEST_HEADERS:Client-Ip|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer "(?:<\?php|<[[:space:]]?\?[[:space:]]?php|<\? php)"

# Rule 310019: phpWebSite SQL-injection 
SecRule REQUEST_URI "/index\.php\?module=\x27\+union\+select\+username\,password\+from\+mod_users\+where\+username="

# Rule 310019: HP-Nuke <=7.8 SQL injection exploit
SecRule REQUEST_URI "/modules\.php" chain
SecRule ARGS:name= "\'.*UNION.*SELECT.*FROM.*users.*WHERE.*user_id=.*AND"

# Rule 310019: My Little Forum 1. SQL injection
SecRule REQUEST_URI "/search\.php\?search.*(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\' UNION SELECT user_pw, user_pw, user_pw, user_pw, user_pw).*&ao=phrase"

# Rule 310019: Interchange Catalog Skeleton SQL Injection and ITL Injection Vulnerabilities
SecRule REQUEST_URI "pages/forum/submit.html" chain
SecRule REQUEST_URI "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\[include\])"

# Rule 310019: Ikonboard "st" and "keywords" SQL Injection Vulnerability
SecRule REQUEST_URI "/ikonboard\.cgi" chain
SecRule ARGS:st|ARGS:keywords "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: ikonboard arbitary file access
SecRule REQUEST_URI "/help\.cgi\?helpon=\.\./"

# Rule 310019: Ikonboard remote file includion
SecRule REQUEST_URI "/register\.cgi" chain
SecRule REQUEST_URI|ARGS "(?:http|https|ftp)\:/"

# Rule 310019: IkonBoard 3.1.1/3.1.2a arbitrary command execution
SecRule REQUEST_URI "/ikonboard\.cgi" chain
SecRule REQUEST_COOKIES:lang "\|"

# Rule 310019: phpMyFAQ vulns
SecRule REQUEST_URI "/index\.php\?LANGCODE=/\.\."

# Rule 310019: phpMyFAQ vulns
SecRule REQUEST_URI "/admin/password\.php" chain
SecRule REQUEST_URI|ARGS "(?:user\: \' or isnull\(1/0\)|mail\:)"

# Rule 310019: phpMyFAQ vulns
SecRule REQUEST_URI "/footer\.php\?PMF_CONF\[version\].*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpMyFAQ vulns
SecRule REQUEST_URI "/admin/header\.php\?PMF_LANG\[metaLanguage\].*(?:\"|<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>)"

# Rule 310019: Riverdark RSS Syndicator XSS attack
SecRule REQUEST_URI "/rss\.php\?(?:forum|topic).*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: ContentServ "ctsWebsite" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/admin/about\.php" chain
SecRule ARGS:ctsWebsite "\.\."

# Rule 310019: AlstraSoft E-Friends "mode" File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:mode "(?:\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: SEO-Board SQL Injection Vulnerability
SecRule REQUEST_URI "/(?:admin|index)\.php" chain
SecRule ARGS:user_pass_sha1 "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: CJ LinkOut "123" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/top\.php" chain
SecRule ARGS:123 "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: jPortal Download Search SQL Injection Vulnerability
SecRule REQUEST_URI "/download\.php" chain
SecRule ARGS:word "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: CJ Tag Board Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/details\.php" chain
SecRule ARGS:date|ARGS:time|ARGS:name|ARGS:ip|ARGS:agent "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: CJ Tag Board Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/details\.php" chain
SecRule REQUEST_URI "/display\.php" chain
SecRule ARGS:msg "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: CJ Web2Mail Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/thankyou\.php" chain
SecRule ARGS:message|ARGS:ip|ARGS:name "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: CJ Web2Mail Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/web2mail\.php" chain
SecRule ARGS:emsg "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: postnuke Local file inclusion via GeSHi library
SecRule REQUEST_URI "/modules/pn_bbcode/pnincludes/contrib/example\.php"

# Rule 310019: TWiki "%INCLUDE" Shell Command Injection Vulnerability
SecRule REQUEST_URI|REQUEST_BODY "INCLUDE.*rev=.*\|.*\}"

# Rule 310019: Barracuda Anti-spam firewall IMG.PL Remote Command Execution
SecRule REQUEST_URI "/img\.pl\?f=(?:\x2e\x2e|\;|\.\.|qq\#|\|)"

# Rule 310019: PHP-Fusion "msg_send" SQL Injection Vulnerability
SecRule REQUEST_URI "/messages\.php" chain
SecRule ARGS:msg_send "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|UNION SELECT user_password FROM fusion_users WHERE user_name|\')"

# Rule 310019: SquirrelMail Address Add Plugin "first" Cross-Site Scripting
SecRule REQUEST_URI "/add\.php" chain
SecRule ARGS:first "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: honeypot
SecRule REQUEST_URI "/tiki-view_forum_thread\.php\?forumid.*=(?:http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI "/upgrade_album\.php\?GALLERY_BASEDIR=(?:http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI "/index\.php\?page=\|"

# Rule 310019: MediaWiki Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI|REQUEST_BODY "\<(?:math|nowiki)\.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: honeypot
SecRule REQUEST_URI "/modules\.php\?op=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "/modules\.php\?op=.*&name=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "/modules\.php\?op=.*&name=.*file=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "/modules\.php\?op=.*&name=.*file=.*sid=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "/view\.php\?cat=.*(?:http|https|ftp)\:/"

# Rule 310019: PHP-Fusion "album" and "photo" SQL Injection Vulnerabilities
SecRule REQUEST_URI "/photogallery\.php" chain
SecRule ARGS:album|ARGS:photo "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: honeypot
SecRule REQUEST_URI "/forumpollrenderer\.php\?bbPath\[.*\]=(?:http|https|ftp)\:/"

# Rule 310019: phorum spam rules
SecRule ARGS:PHORUM_CONFIG "(?:@|(?:http|https|ftp)\:/)"

# Rule 310019: osCommerce "products_id" Additional Images Module SQL Injection
SecRule REQUEST_URI "/product_info\.php" chain
SecRule ARGS:products_id  "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: PHP-Fusion SQL Injection Vulnerabilities
SecRule REQUEST_URI "/register\.php" chain
SecRule ARGS:activate "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: PHP-Fusion SQL Injection Vulnerabilities
SecRule REQUEST_URI "/faq\.php" chain
SecRule ARGS:cat_id "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: Utopia News Pro 1.1.3 SQL injection
SecRule REQUEST_URI "/news\.php\?action=.*&newsid=" chain
SecRule REQUEST_URI|ARGS "(?:UNION.*SELECT.*username,password,null,email,null|(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,])"


# Rule 310019: Utopia News Pro 1.1.3 SQL injection
SecRule REQUEST_URI "/news\.php" chain
SecRule ARGS:newsid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|UNION.*SELECT.*username,password,null,email,null)"

# Rule 310019: wormsign
SecRule REQUEST_URI|REQUEST_BODY "THMC\.\$dbhost\.THMC\.\$dbname\.THMC\.\$dbuser\.THMC\.\$dbpasswd\.THMC"

# Rule 310019: Utopia News Pro Cross-Site Scripting
SecRule REQUEST_URI "/header\.php" chain
SecRule ARGS:sitetitle "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019: Utopia News Pro Cross-Site Scripting
SecRule REQUEST_URI "/footer\.php" chain
SecRule ARGS:query_count|ARGS:version "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpMyAdmin "subform" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/libraries/grab_globals\.lib\.php" chain
SecRule ARGS:subform "(?:/|\.\.|(?:http|https|ftp)\:/)"
# Rule 310019: phpMyAdmin "subform" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/libraries/grab_globals\.lib\.php" chain
SecRule ARGS "(?:/|\.\.|(?:http|https|ftp)\:/)"


# Rule 310019: Cyphor Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "/newmsg\.php" chain
SecRule ARGS:fid "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: Cyphor Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "/lostpwd\.php" chain
SecRule ARGS:email|ARGS:nick  "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: Cyphor Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "/include/footer\.php" chain
SecRule ARGS:t_login "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpbb wormsign
SecRule REQUEST_URI|REQUEST_BODY "echo _GHC/RST_"

# Rule 310019: versatileBulletinBoard 1.00 RC2 sql injection
SecRule REQUEST_URI "/userlistpre\.php\?list=\'"

# Rule 310019: honeypot
SecRule REQUEST_URI "/BlogModel\.php\?path=(?:http|https|ftp)\:/"

# Rule 310019: YaPiG Multiple Vulnerabilities
SecRule ARGS:Website "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: YaPiG Multiple Vulnerabilities
SecRule REQUEST_URI "/view\.php" chain
SecRule ARGS:img_size "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: YaPiG Multiple Vulnerabilities
SecRule ARGS:title "<.*php .*php*\>"

# Rule 310019:  honeypot
SecRule REQUEST_URI "/guest\.php\?name=.*web=.*homepage=.*home=&phone="

# Rule 310019:  W-Agora Remote commands execution
SecRule REQUEST_URI "extras/quicklist\.php\?fake.*(?:<\?|\;system)"
# Rule 310019:  W-Agora Remote commands execution
SecRule REQUEST_URI "avatars/suntzu\.php\?suntzu="
# Rule 310019:  W-Agora Remote commands execution
SecRule REQUEST_URI "extras/quicklist\.php\?suntzu="
# Rule 310019:  W-Agora Remote commands execution
SecRule REQUEST_URI "/browse_avatar\.php" chain
SecRule REQUEST_BODY "Content-Disposition\: form-data\; name=\"avatar\"\;" chain
SecRule REQUEST_BODY "\<\?php" chain
SecRule REQUEST_BODY "\?>"

# Rule 310019: PHPBB remote command execution SQL injection step
SecRule REQUEST_URI "/admin_db_utilities\.php\?sid=.*(?:ALTER TABLE.*VARCHAR.*NOT NULL|DELETE FROM.*WHERE style_name=|SELECT .*passthru.*FROM.*users LIMIT 1 INTO OUTFILE)"
# Rule 310019: PHPBB remote command execution SQL injection step
SecRule REQUEST_URI "/theme_info\.cfg"

# Rule 310019: honeypot
SecRule REQUEST_URI "/item\.php\?pathtoroot=(?:http|https|ftp)\:/"

# Rule 310019: PunBB "old_searches" SQL Injection Vulnerability
SecRule REQUEST_URI "/search\.php" chain
SecRule ARGS:old_searches "(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# Rule 310019: W-Agora Local File Inclusion
SecRule REQUEST_URI "/extras/quicklist\.php" chain
SecRule ARGS:site "(?:/|\.\./\.\.)"

# Rule 310019: Gallery "g2_itemId" Disclosure of Sensitive Information
SecRule REQUEST_URI "/main\.php" chain
SecRule ARGS:g2_itemId "(?:/|\.\./\.\.)"

# Rule 310019: e107 0.617 resetcore.php SQL Injection
SecRule REQUEST_URI "/resetcore\.php" chain
SecRule REQUEST_BODY|ARGS|REQUEST_URI "(?:\'or isnull|siteadmin=suntzu&siteadminemail=fakefakefake@suntzu\.com|a_password=d41d8cd98f00b204e9800998ecf8427e)"

# Rule 310019: e107 "a_name" SQL Injection Vulnerability
SecRule REQUEST_URI "/resetcore\.php" chain
SecRule ARGS:a_name "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"

# Rule 310019: honeypot
SecRule REQUEST_URI "/main\.php\?x=(?:http|https|ftp)\:/"

# Rule 310019:  MySource PEAR_PATH Remote File Inclusion
SecRule REQUEST_URI "/(?:socket|span|request|mimeDecode|mime|mail|date)\.php" chain
SecRule ARGS:PEAR_PATH "(?:http|https|ftp)\:/"
# Rule 310019:  MySource PEAR_PATH Remote File Inclusion
SecRule REQUEST_URI "/new_upgrade_functions\.php" chain
SecRule ARGS:INCLUDE_PATH|ARGS:SQUIZLIB_PATH "(?:http|https|ftp)\:/"
# Rule 310019:  MySource PEAR_PATH Remote File Inclusion
SecRule REQUEST_URI "/init_mysource\.php" chain
SecRule ARGS:INCLUDE_PATH "(?:http|https|ftp)\:/"

# Rule 310019: MySource XSS
SecRule REQUEST_URI "/upgrade_in_progress_backend.php?target_url=\">"
# Rule 310019: MySource XSS
SecRule REQUEST_URI "/insert_table\.php\?bgcolor=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019: MySource XSS
SecRule REQUEST_URI "/edit_table_cell_props\.php\?bgcolor=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019: MySource XSS
SecRule REQUEST_URI "/header\.php\?bgcolor=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019: MySource XSS
SecRule REQUEST_URI "/edit_table_row_props\.php\?bgcolor=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019: MySource XSS
SecRule REQUEST_URI "/edit_table_props\.php\?bgcolor=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
# Rule 310019: MySource XSS
SecRule REQUEST_URI "/edit_table_cell_type_wysiwyg.php?stylesheet=\">"

# Rule 310019: Chipmunk Topsites "ID" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/recommend\.php" chain
SecRule ARGS:ID|ARGS:entryID "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Chipmunk Forum "forumID" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/(?:newtopic|quote|index|reply)\.php" chain
SecRule ARGS:ForumID "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: PHP-Nuke NukeFixes Addon "file" Local File Inclusion Vulnerability
SecRule REQUEST_URI "/modules\.php" chain
SecRule ARGS:files "\.\./"

# Rule 310019: ManageEngine NetFlow Analyzer "grDisp" Cross-Site Scripting
SecRule REQUEST_URI "/index\.jsp" chain
SecRule ARGS:grDisp "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: IBM Lotus Domino XSS attempts
SecRule REQUEST_URI "OpenForm.*/BaseTarget=.*\""
# Rule 310019: IBM Lotus Domino XSS attempts
SecRule REQUEST_URI "OpenFrameSet.*/src=.*\"><\/FRAMESET>.*<script>.*<\/script>"

# Rule 310019: HP OpenView Network Node Manager Remote Command Execution Attempt
SecRule REQUEST_URI "/OvCgi/connectedNodes\.ovpl\?" chain
SecRule ARGS:node "\|"

# Rule 310019: 
SecRule REQUEST_URI "/chat\.php" chain
SecRule ARGS:Username "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"

# Rule 310019: Zomplog Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "detail\.php" chain
SecRule ARGS:id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"
# Rule 310019: Zomplog Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(?:get|index)\.php" chain
SecRule ARGS:catid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"

# Rule 310019: Basic Analysis and Security Engine SQL Injection Vulnerability
SecRule REQUEST_URI "/base_qry_main\.php\?new=.*&sig\[.*\]=\x3D&sig\[.*\]=(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"

# Rule 310019: TClanPortal "id" SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"
SecRule REQUEST_URI "/index\.php\?action=.*id.*UNION.*SELECT.*id="

# Rule 310019: SaphpLesson "forumid" SQL Injection Vulnerability
SecRule REQUEST_URI "/(?:showcat|add)\.php" chain
SecRule ARGS:forumid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\')"

# Rule 310019: PHP-Nuke SQL Injection Vulnerabilities
SecRule REQUEST_URI "/modules\.php\?name=Downloads&d_op=.*&url.*(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION SELECT)"

# Rule 310019: PHP-Nuke SQL Injection Vulnerabilities
SecRule REQUEST_URI "/modules\.php\?name=Web_Links&d_op=.*title=.*description.*(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: PHP-Fusion "news_body" Script Insertion Vulnerability
SecRule REQUEST_URI "/submit\.php" chain
SecRule ARGS:news_body "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: FlatNuke Cross-Site Scripting and Disclosure of Sensitive Information
SecRule REQUEST_URI "/index\.php\?op=profile&user=\.\./"
# Rule 310019: FlatNuke Cross-Site Scripting and Disclosure of Sensitive Information
SecRule REQUEST_URI "/index\.php\?op=newtopic&mode=ris&quale=\.\./.*&page="
# Rule 310019: FlatNuke Cross-Site Scripting and Disclosure of Sensitive Information
SecRule REQUEST_URI "/index\.php\?op=.*&(?:user|nome|from)=*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Mantis File Inclusion
SecRule REQUEST_URI "/bug_sponsorship_list_view_inc\.php\?t_core_path.*(?:(?:http|https|ftp)\:/|\.\.)"

# Rule 310019: PHP iCalendar File Inclusion Vulnerability and XSS
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:phpicalendar "(?:(?:http|https|ftp)\:/|\.\.)"

# Rule 310019: PHP iCalendar File Inclusion Vulnerability and XSS
SecRule REQUEST_URI "phpicalendar=.*cookie_view.*(?:http|https)\:/"

# Rule 310019: RSA ACE/Agent for Web "image" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/webauthentication\?GetPic\?image.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: honeypot
SecRule REQUEST_URI "/tiki-view_cache\.php\?url=\.\./\.\."

# Rule 310019: Woltlab Burning Board Database Module SQL Injection Vulnerabilities
SecRule REQUEST_URI "/info_db\.php" chain
SecRule ARGS:fileid|ARGS:subkatid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: gCards "limit" SQL Injection Vulnerability
SecRule REQUEST_URI "/news\.php" chain
SecRule ARGS:limit "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019:  ATutor Multiple Vulnerabilities
SecRule REQUEST_URI "/forum\.inc\.php\?addslashes.*(?:chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)&(?:asc|desc)="

# Rule 310019:  ATutor Multiple Vulnerabilities
SecRule REQUEST_URI "/(?:body_header\.inc|print)\.php\?section.*(?:/|\.\.)"

# Rule 310019:  ATutor Multiple Vulnerabilities
SecRule REQUEST_URI "admin/translate\.php" chain
SecRule ARGS:_base_href "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019:  ATutor Multiple Vulnerabilities
SecRule REQUEST_URI "include/html/editor_tabs/news\.inc\.php" chain
SecRule ARGS:_base_path "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019:  ATutor Multiple Vulnerabilities
SecRule REQUEST_URI "documentation/add_note\.php" chain
SecRule ARGS:p "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019:  PHP config recon attack
SecRule REQUEST_URI "/php\.ini$"

# Rule 310019:  saphp Lesson add.php forumid Variable SQL Injection
SecRule REQUEST_URI "/(?:showcat|add)\.php\?forumid.*(?:UNION.*SELECT|\|)"

# Rule 310019:   SaveWebPortal menu_dx.php and menu_sx.php Multiple Variable XSS
SecRule REQUEST_URI "/menu_dx\.ph" chain
SecRule ARGS:L_InsertCorrectly|ARGS:L_MENUDX_Login|ARGS:L_MENUDX_Username|ARGS:L_MENUDX_Password|ARGS:L_Ok|ARGS:IMAGES_Url|ARGS:L_MENUDX_Registration|ARGS:BANNER_Url|ARGS:L_MENUSX_Newsletter|ARGS:L_MENUDX_InsertEMail "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019:   SaveWebPortal menu_dx.php and menu_sx.php Multiple Variable XSS
SecRule REQUEST_URI "/menu_sx\.php" chain
SecRule ARGS:L_InsertNOK3Char|ARGS:L_MENUSX_Channels|ARGS:L_MENUSX_Home|ARGS:L_MENUSX_Archive|ARGS:L_Search|ARGS:L_Ok|ARGS:IMAGES_Url|ARGS:L_MENUSX_Services|ARGS:L_MENUSX_Links|ARGS:L_MENUSX_Newsletter|ARGS:L_MENUSX_Polls|ARGS:L_MENUSX_ECards|ARGS:L_MENUSX_Downloads|ARGS:L_MENUSX_Community|ARGS:L_MENUSX_Forum|ARGS:L_MENUSX_Chat|ARGS:L_MENUSX_Nicknames|ARGS:L_MENUSX_Membership|ARGS:L_MENUSX_Login|ARGS:L_MENUSX_UserProfile|ARGS:L_MENUSX_PasswordForgot|ARGS:L_MENUSX_Logout|ARGS:L_MENUSX_Contacts|ARGS:L_MENUSX_Guestbook|ARGS:L_MENUSX_ContactUs "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpbb xss, sql injection and PHP code injection
SecRule REQUEST_URI "usercp_register\.php" chain
SecRule ARGS:error_msg "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpbb xss, sql injection and PHP code injection
SecRule REQUEST_URI "login\.php" chain
SecRule ARGS:forward_page "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpbb xss, sql injection and PHP code injection
SecRule REQUEST_URI "search\.php" chain
SecRule ARGS:list_cat "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: phpbb xss, sql injection and PHP code injection
SecRule REQUEST_URI "usercp_register\.php" chain
SecRule ARGS:signature_bbcode_uid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"
SecRule ARGS:signature_bbcode_uid "(?:<.*php|<php)"

# Rule 310019:  honeypot
SecRule REQUEST_URI "index\.php?x=(?:http|https|ftp)\:/"

# Rule 310019:  honeypot
SecRule REQUEST_URI "/classes\.php\?LOCAL_PATH=(?:http|https|ftp)\:/"

# Rule 310019: News2Net "category" SQL Injection Vulnerability
SecRule REQUEST_URI "index\.php" chain
SecRule ARGS:category "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: eyeOS Script Insertion and Exposure of User Credentials
SecRule REQUEST_URI "desktop\.php" chain
SecRule ARGS:motd "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: eyeOS Script Insertion and Exposure of User Credentials
SecRule REQUEST_URI "/usrinfo\.xml"

# Rule 310019: Invision Gallery "st" SQL Injection Vulnerability
SecRule REQUEST_URI "index\.php" chain
SecRule ARGS:st "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: oaboard SQL Injection Vulnerabilities
SecRule REQUEST_URI "forum\.php" chain
SecRule ARGS:channel|ARGS:topic "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: honeypot
SecRule REQUEST_URI "/main\.php\?\*=(?:http|https|ftp)\:/"

# Rule 310019: CuteNews "template" Local File Inclusion and remote code execution Vulnerabilities
SecRule REQUEST_URI "/show_archives\.php" chain
SecRule ARGS:template "(?:/|\.\.)"

# Rule 310019: cutenews shell injection vuln
SecRule REQUEST_URI "/inc/ipban\.mdu" chain
SecRule ARGS:add_ip "(?:php|system)"

# Rule 310019: cutenews shell injection vuln
SecRule REQUEST_URI "/ipban\.db\.php\?cmd="


# Rule 310019: phpWebThings "forum" SQL Injection Vulnerability
SecRule REQUEST_URI "/forum\.php" chain
SecRule ARGS:forum "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: PHP Handicapper Multiple Vulnerabilities
SecRule REQUEST_URI "/msg\.php" chain
SecRule ARGS:msg  "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: PHP Handicapper Multiple Vulnerabilities
SecRule REQUEST_URI "/process_signup\.php" chain
SecRule ARGS:login  "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: PHP Handicapper Multiple Vulnerabilities
SecRule REQUEST_URI "/process_signup\.php" chain
SecRule ARGS:serviceid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Simple PHP Blog Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI  "/preview(?:_cgi|_static_cgi)\.php" chain
SecRule ARGS:entry  "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"
SecRule REQUEST_URI  "preview_cgi\.php" chain
SecRule ARGS:blog_subject|ARGS:blog_text   "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Simple PHP Blog Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI  "/preview_static_cgi\.php" chain
SecRule ARGS:blog_subject|ARGS:blog_text|ARGS:file_name "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Simple PHP Blog Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI  "/colors_cgi\.php"  chain
SecRule ARGS:scheme_name|ARGS:bg_color "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: honeypot
SecRule REQUEST_URI  "tiki-pagehistory\.php\?page=(?:http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI  "/uniq_login\.php\?login.*(?:http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI  "/viewtopic\.php\?t=.*&highlight=\'"

# Rule 310019: sumthin scan
SecRule REQUEST_URI  "/sumthin"

# Rule 310019: PHPKIT XSS Vulnerability
SecRule REQUEST_URI  "admin/admin\.php" chain
SecRule ARGS:site_body "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: toendaCMS Disclosure of Sensitive Information
SecRule REQUEST_URI  "/admin\.php" chain
SecRule ARGS:id_user "(?:\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: Phorum "forum_ids[]" SQL Injection Vulnerability
SecRule REQUEST_URI  "/search\.php" chain
SecRule ARGS:forums_ids "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Tonio Gallery "galid" SQL Injection Vulnerability
SecRule REQUEST_URI  "/showgallery\.php" chain
SecRule ARGS:galid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: ibProArcade Module "user" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:user "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: XMB "username" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI  "/u2u\.php" chain
SecRule ARGS:username "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: tikiwiki XSS
SecRule REQUEST_URI  "/tiki-view_forum_thread\.php" chain
SecRule ARGS:topics_sort_mode|ARGS:topics_offset "(?:<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=|javascript\:)"

# Rule 310019: Tikiwiki tiki-user_preferences Command Injection Vulnerability
SecRule REQUEST_URI  "/tiki-user_preferences\.php" chain
SecRule ARGS:language "(?:/|\.\.)"

# Rule 310019: Tikiwiki tiki-editpage Arbitrary File Exposure Vulnerability
SecRule REQUEST_URI  "/tiki-editpage\.php" chain
SecRule ARGS:suck_url "(?:/|\.\.)"

# Rule 310019: phpAdsNew SQL Injection Vulnerability
SecRule REQUEST_URI  "/logout\.php" chain
SecRule ARGS:sessiodID "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Moodle "datalib.php" Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(?:datalib|category|info)\.php" chain
SecRule ARGS:id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Moodle "datalib.php" Remote SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/plot\.php" chain
SecRule ARGS:user "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: honeypot
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:Config_absolute_path|ARGS:configFile "(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI  "/error\.php\?dir=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI  "/common\.php\?pun_root=(?:http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI  "tiki-wiki_rss\.php\?ver=.*(?:http|https|ftp)\:/"

# Rule 310019: Winmail Server Multiple Vulnerabilities
SecRule REQUEST_URI  "admin/main\.php" chain
SecRule ARGS:sid "\.\./\.\."
# Rule 310019: Winmail Server Multiple Vulnerabilities
SecRule REQUEST_URI  "badlogin\.php" chain
SecRule ARGS:retid "(?:<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=|javascript\:)"

# Rule 310019: Pearl Forums SQL Injection and Local File Inclusion Vulnerabilities
SecRule REQUEST_URI  "index\.php" chain
SecRule ARGS:forumsid|ARGS:topicid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Pearl Forums SQL Injection and Local File Inclusion Vulnerabilities
SecRule REQUEST_URI  "index\.php" chain
SecRule ARGS:mode "(?:\.\./\.\.|/)"

# Rule 310019: Peel "rubid" SQL Injection Vulnerability
SecRule REQUEST_URI  "index\.php" chain
SecRule ARGS:rubid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: CodeGrrl Products "siteurl" File Inclusion Vulnerability
SecRule REQUEST_URI  "protection\.php" chain
SecRule ARGS:siteurl "(?:\.\./\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: Wizz Forum Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "ForumauthDetails\.php" chain
SecRule ARGS:AuthID "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Wizz Forum Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "ForumTopicDetails\.php" chain
SecRule ARGS:TopicID "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: iCMS "page" File Inclusion Vulnerability
SecRule REQUEST_URI  "ForumauthDetails\.php" chain
SecRule ARGS:page "(?:\.\./\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: Xoops "xoopsConfig[language]" Local File Inclusion Vulnerability
SecRule REQUEST_URI  "editor_registry\.php" chain
SecRule REQUEST_URI "xoopsConfig\[language\].*(?:\.\./\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: PollVote "pollname" File Inclusion Vulnerability
SecRule REQUEST_URI  "pollvote\.php" chain
SecRule ARGS:pollname "(?:\.\./\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: Xoops WF-Downloads Module "list" SQL Injection Vulnerability
SecRule REQUEST_URI  "viewcat\.php" chain
SecRule ARGS:list "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: phpwcms Disclosure of Sensitive Information and Cross-Site Scripting
SecRule REQUEST_URI  "login\.php" chain
SecRule ARGS:form_lang "(?:\.\./\.\.|/|(?:http|https|ftp)\:/)"

# Rule 310019: phpwcms Disclosure of Sensitive Information and Cross-Site Scripting
SecRule REQUEST_URI  "random_image\.php" chain
SecRule ARGS:imgdir "\.\./\.\."

# Rule 310019: OnContent // CMS "pid" SQL Injection Vulnerability
SecRule REQUEST_URI  "index\.php" chain
SecRule ARGS:pid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Mambo "register_globals" Emulation Layer Overwrite Vulnerability
#Mambo <= 4.5.2 Globals overwrite / remote commands execution
SecRule ARGS:mosConfig_absolute_path "(?:\.\./\.\.|/|(?:http|https|ftp)\:/)" "id:390075,rev:1,severity:2,msg:'JITP: Generic mosConfig_absolute_path File Inclusion Vulnerability'"
# Rule 310019: 
SecRule REQUEST_URI "\.php\?.*mosConfig_absolute_path=(?:http|https|ftp)\:\/" "id:390076,rev:1,severity:2,msg:'JITP: Generic mosConfig_absolute_path File Inclusion Vulnerability'"


# Rule 310019: Arki-DB "catid" SQL Injection Vulnerability
SecRule REQUEST_URI  "index\.php" chain
SecRule ARGS:catid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: EkinBoard 1.0.3 config.php SQL Injection through cookie
SecRule REQUEST_COOKIES:username "or isnull\(1"
# Rule 310019: EkinBoard 1.0.3 config.php SQL Injection through cookie
SecRule REQUEST_URI  "&activate=1&allow_attch=1&attch_exts=.*php&.*attch_max_size="
# Rule 310019: EkinBoard 1.0.3 config.php SQL Injection through cookie
SecRule REQUEST_URI  "attachments/suntzu.*\?cmd="

# Rule 310019: HPWebThings 1.4 "msg" and "forum" SQL injection
SecRule REQUEST_URI  "forum\.php\?act=.*&msg.*UNION.*SELECT.*(?:name|password|outfile).*forum="
# Rule 310019: HPWebThings 1.4 "msg" and "forum" SQL injection
SecRule REQUEST_URI  "forum\.php\?forum=.*UNION.*SELECT.*(?:name|password|outfile)"
# Rule 310019: HPWebThings 1.4 "msg" and "forum" SQL injection
SecRule REQUEST_URI  "forum\.php\?act=.*&forum.*UNION.*SELECT.*ORD"

# Rule 310019: phpnuke query sql injection
SecRule REQUEST_URI  "modules\.php" chain
SecRule ARGS:query "(?:\'|UNION.*SELECT)"

# Rule 310019: Cyphor Forum SQL Injection Exploit
SecRule REQUEST_URI  "show\.php" chain
SecRule ARGS:id|ARGS:fid "(?:\'|UNION.*SELECT)"

# Rule 310019: OTRS vulnerabilities, SQL injection and XSS
SecRule REQUEST_URI  "/index\.pl\?Action=(?:Login&User|AgentTicketPlain&(?:ArticleID|TicketID))=.*(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"
# Rule 310019: OTRS vulnerabilities, SQL injection and XSS
SecRule REQUEST_URI  "/index\.pl\?(?:QueueID|Action)=.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Omnistar Live SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/kb\.php" chain
SecRule ARGS:id|ARGS:category_id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Ezyhelpdesk Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/\?mid=.*&m2id=.*page=.*(?:faq_id|c_id).*(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"
# Rule 310019: Ezyhelpdesk Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/\?edit=spec_view&edit_id.*(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: 1-2-3 Music Store "AlbumID" SQL Injection Vulnerability
SecRule REQUEST_URI  "/process\.php" chain
SecRule ARGS:AlbumID "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: PHP Labs Top Auction SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/viewcat\.php" chain
SecRule ARGS:category|ARGS:type "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: PHP Labs Survey Wizard "sid" SQL Injection Vulnerability
SecRule REQUEST_URI  "/survey\.php" chain
SecRule ARGS:sid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: AFFCommerce Shopping Cart Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/subcategory\.php" chain
SecRule ARGS:cl "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"
# Rule 310019: AFFCommerce Shopping Cart Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(?:iteminfo|itemreview)\.php" chain
SecRule ARGS:item_id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: WSN Forum "id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/memberlist\.php" chain
SecRule ARGS:id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Tunez SQL Injection and Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI  "/songinfo\.php" chain
SecRule ARGS:songid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Tunez SQL Injection and Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI  "/search\.php" chain
SecRule ARGS:searchfor "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: PmWiki 2.0.12 Cross Site Scripting
SecRule REQUEST_URI  "/Search\?action=search.*<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: PHP-Post Cross-Site Scripting
SecRule REQUEST_URI  "/(?:profile|mail)\.php" chain
SecRule ARGS:user "<[[:space:]]*(?:script|about|applet|activex|chrome)*>.*(?:script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: CommodityRentals "user_id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/usersession" chain
SecRule ARGS:userid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Joomla! mod_poll SQL Injection
SecRule REQUEST_URI  "/mod_poll" chain
SecRule ARGS:itemid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Advanced Poll "popup.php" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI  "/popup\.php" chain
SecRule ARGS:poll_ident "<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: PHP-Fusion SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/options\.php" chain
SecRule ARGS:forum_id|ARGS:thread_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: PHP-Fusion SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(viewforum|index)\.php" chain
SecRule ARGS:lastvisted "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: phpComasy "id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: honeypot
SecRule REQUEST_URI  "_head\.php\?_zb_path=(http|https|ftp)\:/"

# Rule 310019: vTiger code inclusion attack
SecRule REQUEST_URI  "/vtigercrm\.log"

# Rule 310019: Comdev Vote Caster "campaign_id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:campaign_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Softbiz Web Host Directory Script SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(search_result|browsecats)\.php" chain
SecRule ARGS:cid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Softbiz Web Host Directory Script SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/review\.php" chain
SecRule ARGS:sbres_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Softbiz Web Host Directory Script SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/email\.php" chain
SecRule ARGS:h_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Nicecoder iDesk "cat_id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/faq\.php" chain
SecRule ARGS:cat_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: IsolSoft Support Center SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/search\.php" chain
SecRule ARGS:field|ARGS:lorder "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: AgileBill "id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/\?_page=product_cat\:t_" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: ActiveCampaign SupportTrio "page" Local File Inclusion Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:page "(\.\./\.\.|/(etc|tmp|var)|(http|https|ftp)\:/)"

# Rule 310019: sNews "index.php" SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:id|ARGS:category "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Online Work Order Suite Lite Edition SQL Injection Vulnerability
SecRule REQUEST_URI  "/search\.php" chain
SecRule ARGS:keyword "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: phpWordPress SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:poll|ARGS:category|ARGS:ctg "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Pdjk-support Suite Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:news_id|ARGS:faq_id|ARGS:rowstart "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019:  freeForum 1.x "cat" and "thread" SQL inj.
SecRule REQUEST_URI  "/forum\.php" chain
SecRule ARGS:cat|ARGS:thread "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: ActiveCampaign KnowledgeBuilder SQL Injection
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:article "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Helpdesk Issue Manager SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/issue\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Helpdesk Issue Manager SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/find\.php" chain
SecRule ARGS:orderdir|ARGS:orderby "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Helpdesk Issue Manager SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/find\.php" chain
SecRule REQUEST_URI "detail\[\].*((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Q-News "id" File Inclusion Vulnerability
SecRule REQUEST_URI  "/q-news\.php" chain
SecRule ARGS:id "(\.\./\.\.|/|(http|https|ftp)\:/)"

# Rule 310019: ADC2000 NG Pro "cat" SQL Injection Vulnerability
SecRule REQUEST_URI  "/adcbrowres\.php" chain
SecRule ARGS:cat "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Enterprise Connector "messageid" SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/send\.php" chain
SecRule ARGS:messageid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Softbiz Resource Repository Script SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/showcats\.php" chain
SecRule ARGS:sbcat_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Softbiz Resource Repository Script SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(details_res|refer_friend|report_link)\.php" chain
SecRule ARGS:sbres_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"


# Rule 310019: Netzbrett "p_entry" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:pentry "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: ShockBoard "offset" SQL Injection Vulnerability
SecRule REQUEST_URI  "/topic\.php" chain
SecRule ARGS:offset "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: K-Search SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:id|ARGS:stat|ARGS:source "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: AllWeb Search "search" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:search "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Simple Document Management System SQL Injection Vulnerability
SecRule REQUEST_URI  "/message\.php" chain
SecRule ARGS:mid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"
# Rule 310019: Simple Document Management System SQL Injection Vulnerability
SecRule REQUEST_URI  "/list\.php" chain
SecRule ARGS:folder_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: edmoBBS SQL inj. vuln.
SecRule REQUEST_URI  "/edmobbs9r\.php" chain
SecRule ARGS:table|ARGS:messageID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Joels Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/topiczeigen\.php" chain
SecRule ARGS:nr "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Joels Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(showforum|newtopic)\.php" chain
SecRule ARGS:forum "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Joels Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/showforum\.php" chain
SecRule ARGS:zeigeseite "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Joels Bulletin Board SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/neuerbeitrag\.php" chain
SecRule ARGS:tidnr "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: UGroup Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/forum\.php" chain
SecRule ARGS:FORUM_ID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: UGroup Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/topic\.php" chain
SecRule ARGS:TOPIC_ID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Fantastic News "category" SQL Injection Vulnerability
SecRule REQUEST_URI  "/news\.php" chain
SecRule ARGS:category "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: ClientExec Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:billshowid|ARGS:billdetailid|ARGS:frmClientID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Entergal MX SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:idcat|ARGS:action "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: GuppY PHP Code Injection and Local File Inclusion Vulnerabilities
SecRule REQUEST_URI  "/error\.php" chain
SecRule REQUEST_URI  "_SERVER\[REMOTE_ADDR\].*(php|system\()"

# Rule 310019: GuppY PHP Code Injection and Local File Inclusion Vulnerabilities
SecRule REQUEST_URI  "/editorTypetool\.php" chain
SecRule ARGS:meskin "(\.\./\.\.|/|(http|https|ftp)\:/)"
# Rule 310019: GuppY PHP Code Injection and Local File Inclusion Vulnerabilities
SecRule REQUEST_URI  "/(archbatch|nwlmail)\.php" chain
SecRule ARGS:lng "(\.\./\.\.|/|(http|https|ftp)\:/)"

# Rule 310019: DMANews Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:id|ARGS:sortorder|ARGS:display_num "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: BosDates SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/calendar\.php" chain
SecRule ARGS:year|ARGS:category "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: Post Affiliate Pro "sortorder" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:sortorder "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: BedengPSP Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/(index|download)\.php" chain
SecRule ARGS:cwhere "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: BedengPSP Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/baca\.php" chain
SecRule ARGS:ckode "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: randshop SQL Injection Vulnerabilities
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:kategorieid|ARGS:katid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: SourceWell "cnt" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:cnt "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: phpGreetz Include File Bug
SecRule REQUEST_URI  "/content\.php" \
	"id:319999,rev:3,severity:2,msg:'phpGreetz Include file attack',chain"
SecRule ARGS:content "(\.\./\.\.|/|(http|https|ftp):/)"

# Rule 310019: Athena Include File Bug
SecRule REQUEST_URI  "/athena\.php" chain
SecRule ARGS:athena_dir "(\.\./\.\.|/|(http|https|ftp)\:/)"

# Rule 310019: Athena Include File Bug vulns
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:module "\.\./"
# Rule 310019: Athena Include File Bug vulns
SecRule REQUEST_URI  "/index\.php" chain
SecRule REQUEST_URI "Users\&Action.*templatename.*/"
# Rule 310019: Athena Include File Bug vulns
SecRule REQUEST_URI "/index\.php\?module=uploads&action=add2db" chain
SecRule REQUEST_URI|REQUEST_BODY  "\.php"

# Rule 310019: Fake gif file shell attacvk
SecRule REQUEST_HEADERS:Content-Type "image/gif"

# Rule 310019: Fake gif file shell attacvk
SecRule REQUEST_BODY "chr\("

# Rule 310019: bogus graphics file
SecRule REQUEST_HEADERS:Content-Disposition "\.php" chain
SecRule REQUEST_HEADERS:Content-Type "(image/gif|image/jpg|image/png|image/bmp)"

# Rule 310019: Post Affiliate Pro "sortorder" Remote SQL Injection and Arbitrary File Inclusion Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:md "(\.\./\.\.|/)"

# Rule 310019: Post Affiliate Pro "sortorder" Remote SQL Injection and Arbitrary File Inclusion Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:sortorder "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: EkinBoard 1.0.3 (config.php) SQL Injection / Command Execution
SecRule REQUEST_URI  "/(index|viewforum|newtopic)\.php" chain
SecRule REQUEST_COOKIES:username "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

# Rule 310019: EkinBoard 1.0.3 (config.php) SQL Injection / Command Execution
SecRule REQUEST_URI  "/newtopic\.php" chain
SecRule REQUEST_HEADERS:Content-Disposition "topic_title" chain
SecRule REQUEST_BODY "php.*system\("

# Rule 310019: Unclassified NewsBoard 1.5.3 patch level 3 "Datefrom" blind SQL injection
SecRule REQUEST_URI  "/forum\.php" chain
SecRule ARGS:DateFrom "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PHPNuke <= 7.8 sql injection
SecRule REQUEST_URI  "/forum\.php" chain
SecRule ARGS:query "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Moodle <= 1.6dev get record()  SQL injection
SecRule REQUEST_URI  "/plot\.php" chain
SecRule ARGS:user "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Moodle <= 1.6dev get record()  SQL injection
SecRule REQUEST_URI  "/info\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: interesting new pattern
SecRule REQUEST_URI  "/ThisFileMustNotExist"

# Rule 310019: honeypot
SecRule REQUEST_URI  "/tiki-backlinks\.php\?page=(http|https|ftp)\:/"

# Rule 310019:  SocketKB 1.1.x file include Vuln
SecRule REQUEST_URI "\?__f=(http|https|ftp)\:/"
# Rule 310019:  SocketKB 1.1.x file include Vuln
SecRule REQUEST_URI "\?__f=rating_add&"
# Rule 310019:  SocketKB 1.1.x file include Vuln
SecRule ARGS:art_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"
# Rule 310019:  SocketKB 1.1.x file include Vuln
SecRule REQUEST_URI "\?__f=category&"
# Rule 310019:  SocketKB 1.1.x file include Vuln
SecRule ARGS:node "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Xaraya "module" Local File Inclusion Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:module "(\.\./\.\.|/)"

# Rule 310019: N-13 News "id" SQL Injection Vulnerability
SecRule REQUEST_URI  "/index\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Softbiz B2B Trading Marketplace Script "cid" SQL Injection
SecRule REQUEST_URI  "/(selloffers|buyoffers|products|profiles)\.php" chain
SecRule ARGS:cid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019:  WEB-MISC mod_gzip_status access
SecRule REQUEST_URI "/mod_gzip_status" log,pass

# Rule 310019: honeypot
SecRule REQUEST_URI "/index\.php\?main=/"

# Rule 310019: PHP Fusion CMS SQL injection Vulnerabilities
SecRule REQUEST_URI "/viewforum\.php\?" chain
SecRule ARGS:lastvisited "\'"

# Rule 310019: Saxon XSLT command execution attacks
SecRule REQUEST_URI|REQUEST_BODY "xsl\:value-of select=\"run\:exec\("

# Rule 310019: Saxon XSLT command execution attacks
SecRule REQUEST_URI|REQUEST_BODY "xsl.*run\:getRuntime\(\)\, \'\""

# Rule 310019: Lore Article.PHP SQL Injection Vulnerability
SecRule REQUEST_URI "/article\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: honeypoy
SecRule REQUEST_URI "/imageviewer\.php\?filename="

# Rule 310019: PhpX <= 3.5.9 SQL Injection -> login bypass -> remote command/code execution
SecRule REQUEST_URI "/admin/" chain 
SecRule ARGS:username "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM|or user_id=2)"

# Rule 310019: PhpX <= 3.5.9 SQL Injection -> login bypass -> remote command/code execution
SecRule REQUEST_URI "files/.*\.php\.menu\?cmd="

# Rule 310019: NetClassifieds Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(ViewCat|gallery)\.php" chain
SecRule ARGS:Catid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: NetClassifieds Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/ViewItem\.php" chain
SecRule ARGS:ItemNum "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Coppermine Photo Gallery "relocate_server.php" Exposure of Configuration
SecRule REQUEST_URI "/relocate_server\.php"

# Rule 310019: WebCalendar HTTP Response Splitting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "/edit_report_handler\.php" chain
SecRule ARGS:time_range "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: WebCalendar HTTP Response Splitting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "/layers_toggle\.php" chain
SecRule ARGS:ret "HTTP"

# Rule 310019: Instant Photo Gallery SQL Injection Vulnerabilities
SecRule REQUEST_URI "/portfolio\.php" chain
SecRule ARGS:cat_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Instant Photo Gallery SQL Injection Vulnerabilities
SecRule REQUEST_URI "/content\.php" chain
SecRule ARGS:cid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Lore "id" SQL Injection Vulnerability
SecRule REQUEST_URI "/article\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: DotClear "dc_xd" SQL Injection Vulnerability
SecRule REQUEST_URI "/session\.php" chain
SecRule REQUEST_COOKIES:cd_xd "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: DotClear "dc_xd" SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:x "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: O-Kiraku Nikki "day_id" SQL Injection Vulnerability
SecRule REQUEST_URI "/nikki\.php" chain
SecRule ARGS:day_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019:  AltantisFAQ SQL inj. vuln.
SecRule REQUEST_URI "/search\.php" chain
SecRule ARGS:searchStr "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: FAQRing "id" SQL Injection Vulnerability
SecRule REQUEST_URI "/answer\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: WSN Knowledge Base SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:catid|ARGS:perpage|ARGS:ascdesc|ARGS:orderlinks "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: WSN Knowledge Base SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(comments|memberlist)\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Softbiz FAQ Script SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(faq_qanda|refer_friend|print_article|add_comment)\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Softbiz FAQ Script SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:cid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: OmniStar KBase SQL Injection Vulnerabilities
SecRule REQUEST_URI "/comments\.php" chain
SecRule ARGS:article_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: OmniStar KBase SQL Injection Vulnerabilities
SecRule REQUEST_URI "/kb\.php" chain
SecRule ARGS:category_id|ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: FAQ System SQL Injection Vulnerabilities
SecRule REQUEST_URI "/viewFAQ\.php" chain
SecRule ARGS:FAQ_ID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: FAQ System SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:CATEGORY_ID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: KBase Express SQL Injection Vulnerabilities
SecRule REQUEST_URI "/category\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Orca Knowledgebase "qid" SQL Injection Vulnerability
SecRule REQUEST_URI "/knowledgebase\.php" chain
SecRule ARGS:qid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Survey System "SURVEY_ID" SQL Injection Vulnerability
SecRule REQUEST_URI "/survey\.php" chain
SecRule ARGS:SURVEY_ID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Orca Blog SQL inj. vuln.
SecRule REQUEST_URI "/blog\?msg=((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Orca Ringmaker "start" SQL Injection Vulnerability
SecRule REQUEST_URI "/ringmaker\.php" chain
SecRule ARGS:start "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: ltwCalendar "id" SQL Injection Vulnerability
SecRule REQUEST_URI "/calendar\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Nephp Publisher SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.html" chain
SecRule ARGS:id|ARGS:nnet_catid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Zainu SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:start|ARGS:term "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Babe Logger "gal" and "id" SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:gal "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Babe Logger "gal" and "id" SQL Injection Vulnerabilities
SecRule REQUEST_URI "/comments\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Zen Cart Input Validation Hole in 'password_forgotten.php' sql injection
SecRule REQUEST_URI "admin/password_forgotten\.php" chain
SecRule ARGS:admin_email "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO)"

# Rule 310019: Sugar Suite "beanFiles[1]" File Inclusion Vulnerability
SecRule REQUEST_URI "acceptDecline\.php" chain
SecRule REQUEST_URI "beanFiles\[1\].*(http|https|ftp)\:/"

# Rule 310019: phpMyAdmin register_globals Emulation "import_blacklist" Manipulation
SecRule REQUEST_URI "/grab_globals\.php" chain
SecRule ARGS:import_blacklist "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|(http|https|ftp)\:/)"

# Rule 310019: Magic Forum Personal Cross-Site Scripting and SQL Injection
SecRule REQUEST_URI "/view_forum\.cfm" chain
SecRule ARGS:ForumID|ARGS:Thread|ARGS:ThreadID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO)"

# Rule 310019: Magic Forum Personal Cross-Site Scripting and SQL Injection
SecRule REQUEST_URI "/search_forums\.cfm" chain
SecRule ARGS:Words "<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: Magic List Pro "ListID" SQL Injection Vulnerability
SecRule REQUEST_URI "/view_archive\.cfm" chain
SecRule ARGS:ListID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO)"

# Rule 310019: CF_Nuke Directory Traversal and Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "/index\.cfm" chain
SecRule ARGS:sector|ARGS:page "\.cfm"

# Rule 310019: phpForumPro SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:parent|ARGS:day "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Cars Portal SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:page|ARGS:car "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PluggedOut Blog "index.php" SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:categoryid|ARGS:entryid|ARGS:year|ARGS:month|ARGS:day "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PluggedOut Nexus SQL Injection and Cross-Site Scripting
SecRule REQUEST_URI "/search\.php" chain
SecRule ARGS:firstname|ARGS:lastname|ARGS:location "(((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)|<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>)"

# Rule 310019: PluggedOut Nexus SQL Injection and Cross-Site Scripting
SecRule REQUEST_URI "/search_forums\.cfm" chain
SecRule ARGS:Words "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: honeypot
SecRule REQUEST_URI "/tiki-view_forum_thread\.php" "chain,id:390083,rev:1,severity:2,msg:'JITP: tikiwiki XSS Vulnerability'"
SecRule ARGS:comments_parentId|ARGS:forumId|ARGS:topics_offset "(<+(script|about|applet|activex|chrome)|onmouseover=\'javascript)"

# Rule 310019: honeypot
SecRule REQUEST_URI "/tiki-view_forum_thread\.php" "chain,id:390082,rev:1,severity:2,msg:'JITP: tikiwiki Remote File Inclusion Vulnerability'"
SecRule ARGS:comments_parentId|ARGS:forumId|ARGS:topics_offset "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

# Rule 310019:  wormsign
SecRule REQUEST_URI "Hacked.*by.*member.*of.*SCC"

# Rule 310019:  phpMyAdmin Cross-Site Scripting Vulnerabilities
SecRule ARGS:REQUEST_HEADERS:Host "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=|javascript\:)"

# Rule 310019:  Web4Future eCommerce Products SQL Injection Vulnerabilities
SecRule REQUEST_URI "/view\.php" chain
SecRule ARGS:prod|ARGS:brid  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019:  Web4Future eCommerce Products SQL Injection Vulnerabilities
SecRule REQUEST_URI "/viewbrands\.php" chain
SecRule ARGS:bid  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019:  Web4Future eCommerce Products SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:grp|ARGS:cat  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: DoceboLMS Information Disclosure 
SecRule REQUEST_URI "/connector\.php" chain
SecRule ARGS:Type  "\.\."

# Rule 310019: Web4Future Affiliate Manager Pro "pid" SQL Injection Vulnerability
SecRule REQUEST_URI "/functions\.php" chain
SecRule ARGS:pid  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PHP-addressbook "view.php" SQL Injection Vulnerability
SecRule REQUEST_URI "/view\.php" chain
SecRule ARGS:id  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Blog System SQL Injection Vulnerabilities
SecRule REQUEST_URI "/blog\.php" chain
SecRule ARGS:note  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Blog System SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:cat  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Multiple vendor vulnerability
#Amazon Search Directory "search.cgi" Cross-Site Scripting
#Warm Links "search.cgi" Cross-Site Scripting Vulnerability
#Hot Links SQL "search.cgi" Cross-Site Scripting Vulnerability
#Hot Links Pro "search.cgi" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/search\.cgi" chain
SecRule ARGS:search "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: 1-Search "1search.cgi" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/1search\.cgi" chain
SecRule ARGS:q "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Easy Search System "search.cgi" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/search\.cgi" chain
SecRule ARGS:q "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: phpYellow SQL Injection Vulnerabilities
SecRule REQUEST_URI "/search_result\.php" chain
SecRule ARGS:haystack  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: phpYellow SQL Injection Vulnerabilities
SecRule REQUEST_URI "/print_me\.php" chain
SecRule ARGS:ckey  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Relative Real Estate Systems "mls" SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:mls  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: LandShop SQL Injection Vulnerabilities
SecRule REQUEST_URI "/ls\.php" chain
SecRule ARGS:search_order|ARGS:search_type|ARGS:search_area|ARGS:keyword  "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Widget Imprint "product_id" SQL Injection Vulnerability
SecRule REQUEST_URI "/create\.php" chain
SecRule ARGS:product_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Widget Property SQL Injection Vulnerabilities
SecRule REQUEST_URI "/property\.php" chain
SecRule ARGS:property_id|ARGS:zip_code|ARGS:property_type_id|ARGS:price|ARGS:city_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Web4Future Portal Solutions Information Disclosure and SQL Injection
SecRule REQUEST_URI "/comentarii\.php" chain
SecRule ARGS:idp "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Web4Future Portal Solutions Information Disclosure and SQL Injection
SecRule REQUEST_URI "/archiva\.php" chain
SecRule ARGS:dir  "\.\."

# Rule 310019: HobSR "view.php" SQL Injection Vulnerability
SecRule REQUEST_URI "/view\.php" chain
SecRule ARGS:arrange "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Web4Future eDating Professional SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:s|ARGS:pg|ARGS:sortb "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Web4Future eDating Professional SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(gift|fq)\.php" chain
SecRule ARGS:cid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Web4Future eDating Professional SQL Injection Vulnerabilities
SecRule REQUEST_URI "/articles\.php" chain
SecRule ARGS:cat "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: FileLister "searchwhat" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "/definesearch\.jsp" chain
SecRule ARGS:searchwhat "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: PHP-Fusion "srch_text" SQL Injection Vulnerability
SecRule REQUEST_URI "/messages\.php" chain
SecRule ARGS:srch_text "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Nortel SSL VPN Web Interface  XSS
SecRule REQUEST_URI "/tunnelform\.yaws" chain
SecRule ARGS:a "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "BrowseResources\.php\?ParentId=\'"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-UserLogin\.php" chain
SecRule ARGS:F_UserName|ARGS:F_Password "(\'|<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-FullRecord\.php" chain
SecRule ARGS:ResourceId "(\'|<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-BrowseResources\.php" chain
SecRule ARGS:ParentId "(\'|<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-Home\.php" chain
SecRule ARGS:ResourceOffset "(\'|<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-QuickSearch\.php" chain
SecRule ARGS:ss|ARGS:F_SearchString "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-BrowseResources\.php" chain
SecRule ARGS:ParentId "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Scout Portal Toolkit Possible Sql Injection..and XSS
SecRule REQUEST_URI "SPT\-\-AdvancedSearch\.php" chain
SecRule ARGS "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Magic Book v2.0 Professional XSS Vuln
SecRule REQUEST_URI "/book\.cfm\?StartRow.*(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: flatnuke remote shell
SecRule REQUEST_URI "verify\.php" chain
SecRule REQUEST_URI|REQUEST_BODY "mod=modcont&from=index\.php&body=.*\<\?php.*&file=forum.*users.*\.php"

# Rule 310019: flatnuke remote shell
SecRule REQUEST_URI "forum/users/.*\.php\?cmd="

# Rule 310019: Netref "cat" SQL Injection Vulnerability
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:cat "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: milliscripts Redirection "domainname" Cross-Site Scripting
SecRule REQUEST_URI "register\.php" chain
SecRule ARGS:domainname "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: phpnuke exploit
SecRule REQUEST_URI "/modules\.php\?name=Search&type=comments&query=.*&instory=.*UNION.*SELECT.*pwd.*FROM.*nuke_authors"

# Rule 310019: limbo exploit
SecRule REQUEST_URI "index2\.php\?cmd.*\&_SERVER\[\]=\&_SERVER\[REMOTE_ADDR\]=" chain
SecRule REQUEST_URI|REQUEST_BODY "system"

# Rule 310019: Plogger '/admin/plog-admin-functions.php' Include File Bug Lets Remote Users Execute
SecRule REQUEST_URI "admin/plog-admin-functions\.php\?config\[basedir\]=(http|https|ftp)\:/"

# Rule 310019: PHPGedView <= 3.3.7 remote commands execution
SecRule REQUEST_URI "help_text_vars\.php\?.*=.*PGV_BASE_DIRECTORY=./index/pgv.*\.log"

# Rule 310019: PHPGedView <= 3.3.7 remote commands execution
SecRule REQUEST_URI "help_text_vars\.php\?.*=.*PGV_BASE_DIRECTORY=./index/pgv.*\.log"

# Rule 310019: PHPGedView <= 3.3.7 remote commands execution
SecRule REQUEST_URI "help_text_vars\.php\?suntzu="

# Rule 310019: AlstraSoft EPay Enterprise Script Insertion Vulnerabilities
SecRule REQUEST_URI "(profile|card|bank|subscriptions|send|request|forgot|escrow|donations|products)\.htm" chain
SecRule ARGS "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019:  PHP-Fusion Multiple Vulnerabilities
SecRule REQUEST_URI "members\.php" chain
SecRule ARGS:sortby "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"
# Rule 310019:  PHP-Fusion Multiple Vulnerabilities
SecRule REQUEST_URI "ratings_include\.php" chain
SecRule ARGS:rating "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: e-publish Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "printer_friendly\.cfm" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: e-publish Cross-Site Scripting and SQL Injection Vulnerabilities
SecRule REQUEST_URI "show\.cfm" chain
SecRule ARGS:obcatid|ARGS:comid "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: eggblog "q" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "search\.php" chain
SecRule ARGS:q "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019:  SyntaxCMS XSS vuln.
SecRule REQUEST_URI "/search/\?search_query=*(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: SPIP Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "spip_(login|pass)\.php3" chain
SecRule ARGS "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: SiteSage "norelay_highlight_words" Cross-Site Scripting Vulnerability
SecRule ARGS:norelay_highlight_words "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: OpenEdit Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "results\.html" chain
SecRule ARGS:oe-action|ARGS:page "(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=\'javascript)"

# Rule 310019: Portfolio NetPublish "template" Disclosure of Sensitive Information
SecRule REQUEST_URI "server\.np\?base&site=\[.*\]&catalog=.*&template=*\.\./"

# Rule 310019: Papoo SQL Injection Vulnerabilities
SecRule REQUEST_URI "(index|guestbook)\.php" chain
SecRule ARGS:menuid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Papoo SQL Injection Vulnerabilities
SecRule REQUEST_URI "print\.php" chain
SecRule ARGS:forumid|ARGS:reporeid_print "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: phpSlash "story_id" SQL Injection Vulnerability
SecRule REQUEST_URI "article\.php" chain
SecRule ARGS:story_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PhpGedView File Inclusion and PHP Code Injection Vulnerabilities
SecRule REQUEST_URI "authenticate\.php" chain
SecRule ARGS:user_language|ARGS:user_email|ARGS:user_gedcomid  "\<.*php"

# Rule 310019: Miraserver SQL Injection Vulnerabilities
SecRule REQUEST_URI "index\.php" chain
SecRule ARGS:page "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Miraserver SQL Injection Vulnerabilities
SecRule REQUEST_URI "newsitem\.php" chain
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Miraserver SQL Injection Vulnerabilities
SecRule REQUEST_URI "article\.php" chain
SecRule ARGS:cat "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Information Call Center "CallCenterData.mdb" Exposure of User Credentials
SecRule REQUEST_URI "CallCenterData\.mdb" 

# Rule 310019: phpBB <= 2.0.17 remote command execution exploit
SecRule REQUEST_URI "profile\.php\?GLOBALS\[signature_bbcode_uid\]=\(\.\x2B\)/e\x00"

# Rule 310019: phpBB <= 2.0.17 remote command execution exploit
SecRule REQUEST_URI|REQUEST_BODY "r57phpBB2017xpl"

# Rule 310019: phpBB <= 2.0.17 remote command execution exploit
SecRule REQUEST_BODY "_bill_gates@microsoft\.com"

# Rule 310019: phpDocumentor File Inclusion Vulnerabilities
SecRule REQUEST_URI "Documentation/tests/bug-559668\.php"  chain
SecRule ARGS:FORUM\[LIB\] "(http|https|ftp)\:/"

# Rule 310019: phpDocumentor File Inclusion Vulnerabilities
SecRule REQUEST_URI "docbuilder/file_dialog\.php" chain
SecRule ARGS:root_dir "(http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI "/tiki-index\.php\?page=(\||/|\.)"
# Rule 310019: honeypot
SecRule REQUEST_URI "/tech_o\.php\?absolute_path=(http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "moblog_lib\.php\?basedir=(cmd|(http|https|ftp)\:/)"

# Rule 310019: FlatCMS <=1.01 Remote Command Execution Exploit
SecRule REQUEST_URI "/admin/cijfer\.php\?cij="
# Rule 310019: FlatCMS <=1.01 Remote Command Execution Exploit
SecRule REQUEST_URI "/admin/file_editor\.php" chain
SecRule REQUEST_URI "\?save_file=cijfer\.php&f_content="
# Rule 310019: FlatCMS <=1.01 Remote Command Execution Exploit
SecRule REQUEST_URI "/admin/file_editor\.php" chain
SecRule REQUEST_URI  "\x3C\x3F\x24"
#the specific payload, if you prefer
#SecRule REQUEST_URI  "\x3C\x3F\x24handle\x3Dpopen\x5C\x28\x24_GET\x5Bcij\x5D\x2C\x22r\x22\x29\x3Bwhile\x28\x21feof\x28\x24handle\x29\x29\x7B\x24line\x3Dfgets\x28\x24handle\x29\x3Bif\x28strlen\x28\x24line\x29\x3E\x3D1\x29\x7Becho\x22\x24line\x22\x3B\x7D\x7Dpclose\x28\x24handle\x29\x3B\x3F\x3E"

# Rule 310019: Valdersoft Shopping Cart <=3.0 Remote Command Execution Exploit
SecRule REQUEST_URI  "/include/templates/categories/default\.php\?.*\;echo"
# Rule 310019: Valdersoft Shopping Cart <=3.0 Remote Command Execution Exploit
SecRule REQUEST_URI  "/include/templates/categories/default\.php\?.*<\?passthru\(\$_GET\[cmd\]\)\;\?>"
# Rule 310019: Valdersoft Shopping Cart <=3.0 Remote Command Execution Exploit
SecRule ARGS:catalogDocumentRoot  "(https|http|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI "index\.php\?p=(http|https|ftp)\:/"

# Rule 310019: Phgstats "phgdir" File Inclusion Vulnerability
SecRule REQUEST_URI "phgstats\.inc\.php" chain
SecRule ARGS:phgdir "(http|https|ftp)\:/"

# Rule 310019: VenomBoard SQL Injection Vulnerabilities
SecRule REQUEST_URI "post\.php3" chain
SecRule ARGS:topic_id|ARGS:root|ARGS:parent "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019:  PHPNuke EV 7.7 'search' module 'query' variable SQL injection
SecRule REQUEST_URI "/modules\.php\?name=Search" chain
SecRule REQUEST_URI "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: honeypot
SecRule REQUEST_URI "/admin\.php\?op=AddAuthor&add_aid=.*&add_name=.*&add_pwd=.*&add_email=r00t_System@hush\.com"

# Rule 310019: Etomite "cij" shell command backdoor
SecRule REQUEST_URI "manager/includes/todo\.inc\.php"

# Rule 310019: openSRS exploit
SecRule REQUEST_URI "mod_opensrs/mod_config\.php\?this_mod_opensrs_config.*=.*&DIR=(http|https|ftp)\:/"

# Rule 310019: honeypot
SecRule REQUEST_URI "/index\.php" chain
SecRule ARGS:lp "(http|https|ftp)\:/"
# Rule 310019: honeypot
SecRule REQUEST_URI "\.php\?forum=.*union.*select.*password,password,null,null"
SecRule REQUEST_URI "/wwForum\.mdb"

# Rule 310019: ImpExData.php?systempath=
SecRule REQUEST_URI "/ImpExData\.php" chain
SecRule ARGS:systempath "(http|https|ftp)\:/"

# Rule 310019: SQuery <= 4.5 Remote File Inclusion Exploit
SecRule REQUEST_URI "lib/(armygame|ase|devi|doom3|et|flashpoint.php|gameSpy|gameSpy2|gore|gsvari|halo|hlife|hlife2|igi2|main.lib|netpanzer|old_hlife|pkill|q[23]a|qworlp|rene|rvbshld|savage|simracer|sof1|sof2|unreal|ut2004|vietcong)\.php" chain
SecRule ARGS:libpath "(http|https|ftp)\:/"

# Rule 310019: MonAlbum Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "index\.php" chain
SecRule ARGS:pc "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"
# Rule 310019: MonAlbum Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "image_agrandir.php" chain
SecRule ARGS:pnom|ARGS:pcourriel "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PHPNuke-Clan "vwar_root" File Inclusion Vulnerability
#VWar <= 1.5.0 R12 Remote File Inclusion Exploit
SecRule REQUEST_URI "(/includes/functions_(common|install)|/includes/get_header)\.php" "chain,id:390039,rev:2,severity:2,msg:'JITP: vwar_root remote/local file inclusion'"
SecRule ARGS:vwar_root "((http|https|ftp)\:/|\.\./\.\.)"

# Rule 310019: gtd-php Cross-Site Scripting and Script Insertion Vulnerabilities
SecRule REQUEST_URI "new(Project|List|WaitingOn|ChecklistContext|Category.php|Goal)\.php" chain
SecRule ARGS  "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"

# Rule 310019: gtd-php Cross-Site Scripting and Script Insertion Vulnerabilities
SecRule REQUEST_URI "listReport\.php" chain
SecRule ARGS:listTitle "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"
# Rule 310019: gtd-php Cross-Site Scripting and Script Insertion Vulnerabilities
SecRule REQUEST_URI "projectReport\.php" chain
SecRule ARGS:projectName "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"
# Rule 310019: gtd-php Cross-Site Scripting and Script Insertion Vulnerabilities
SecRule REQUEST_URI "checklistReport\.php" chain
SecRule ARGS:checklistTitle "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "post\.php" "chain,id:390001,rev:1,severity:2,msg:'JITP: aWebBB XSS attack on post.php'"
SecRule ARGS:tname|ARGS:fpost "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "editac\.php" "chain,id:390002,rev:1,severity:2,msg:'JITP: aWebBB XSS attack on editac.php'"
SecRule ARGS:fullname|ARGS:emailadd|ARGS:country|ARGS:sig|ARGS:otherav "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "register\.php" "chain,id:390003,rev:1,severity:2,msg:'JITP: aWebBB XSS attack on register.php'"
SecRule ARGS:fullname|ARGS:emailadd|ARGS:country "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "(?:accounts|changep|editac|feedback|fpass|login|post|reply|reply_log)\.php" "chain,id:390004,rev:2,severity:2,msg:'JITP: aWebBB XSS attack'"
SecRule ARGS:Username "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*|\,]|UNION.*SELECT.*FROM)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "dpost\.php" "chain,id:390004,rev:1,severity:2,msg:'JITP: aWebBB SQL attack'"
SecRule ARGS:p "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "(?:ndis|list)\.php" "chain,id:390005,rev:1,severity:2,msg:'JITP: aWebBB SQL attack'"
SecRule ARGS:c "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: aWebBB Multiple Vulnerabilities
SecRule REQUEST_URI "search\.php" "chain,id:390005,rev:1,severity:2,msg:'JITP: aWebBB SQL attack'"
SecRule ARGS:q "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: phpBB "cur_password" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "profile\.php" "chain,id:390006,rev:1,severity:2,msg:'JITP: phpBB cur_password XSS attack'"
SecRule ARGS:cur_password "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit
SecRule REQUEST_URI "modules/vWar_Account/includes/functions_(?:common|front)\.php" "chain,id:390007,rev:2,severity:2,msg:'JITP: PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit'"
SecRule ARGS:vwar_root2 "(?:http|https|ftp)\:/"

# Rule 310019: Claroline <= 1.7.4 scormExport.inc.php remote command vuln
SecRule REQUEST_URI "scormExport\.inc\.php" "chain,id:390008,rev:1,severity:2,msg:'JITP: Claroline <= 1.7.4 scormExport.inc.php remote command vuln'"
SecRule ARGS:includePath "(?:(?:http|https|ftp)\:/|\.\./\.\.)"

# Rule 310019: Claroline <= 1.7.4 scormExport.inc.php remote command vuln
SecRule REQUEST_URI "scormExport\.inc\.php\?cmd=" "id:390009,rev:1,severity:2,msg:'JITP: Claroline <= 1.7.4 scormExport.inc.php remote command vuln'"

# Rule 310019: Claroline <= 1.7.4 XSS and recursion attack
SecRule REQUEST_URI "rqmkhtml\.php" "chain,id:390010,rev:1,severity:2,msg:'JITP: Claroline <= 1.7.4 XSS attack'"
SecRule ARGS:cmd "(?:rqEdit|rwEditHtml)" chain
SecRule ARGS:file "(?:><|\.\./\.\.)"

# Rule 310019: aWebNews Multiple Vulnerabilities
SecRule REQUEST_URI "visview\.php" "chain,id:390011,rev:1,severity:2,msg:'JITP: aWebNews XSS attack'"
SecRule ARGS:yname|ARGS:emailadd|ARGS:subject|ARGS:comment "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: aWebNews Multiple Vulnerabilities
SecRule REQUEST_URI "(?:login|fpass)\.php" "chain,id:390012,rev:1,severity:2,msg:'JITP: aWebBBNewsSQL attack'"
SecRule ARGS:user123 "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: aWebNews Multiple Vulnerabilities
SecRule REQUEST_URI "visview\.php" "chain,id:390013,rev:1,severity:2,msg:'JITP: aWebBBNewsSQL attack'"
SecRule ARGS:cid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: WebAPP Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "index\.cgi" "chain,id:390014,rev:1,severity:2,msg:'JITP: aWebAPP XSS attack'"
SecRule ARGS:action|ARGS:id|ARGS:num|ARGS:board|ARGS:cat|ARGS:writer|ARGS:viewcat|ARGS:img|ARGS:curcatname|ARGS:vsSD "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: qliteNews "loginprocess.php" SQL Injection Vulnerability
SecRule REQUEST_URI "loginprocess\.php" "chain,id:390015,rev:1,severity:2,msg:'JITP: qliteNEws SQL injection attack'"
SecRule ARGS:username "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: RedCMS SQL Injection and Script Insertion Vulnerabilities
SecRule REQUEST_URI "/login\.php" "chain,id:390016,rev:1,severity:2,msg:'JITP: RedCMS SQL Injection'"
SecRule ARGS:username "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|UNION.*SELECT.*FROM)"

# Rule 310019: RedCMS SQL Injection and Script Insertion Vulnerabilities
SecRule REQUEST_URI "profile\.php" "chain,id:390017,rev:1,severity:2,msg:'JITP: RedCMS SQL Injection'"
SecRule ARGS:u "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"
# Rule 310019: RedCMS SQL Injection and Script Insertion Vulnerabilities
SecRule REQUEST_URI "register\.php" "chain,id:390018,rev:1,severity:2,msg:'JITP: RedCMS XSS attack'"
SecRule ARGS:Email|ARGS:Location|ARGS:Website "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: Oxygen "fid" SQL Injection Vulnerability
SecRule REQUEST_URI "post\.php" "chain,id:390019,rev:1,severity:2,msg:'JITP: Oxygen SQL Injection'"
SecRule ARGS:fid "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Mantis Cross-Site Scripting Vulnerabilities
SecRule REQUEST_URI "view_set_all\.php" "chain,id:390020,rev:1,severity:2,msg:'JITP: Mantis XSS attack'"
SecRule ARGS:start_day|ARGS:start_year|ARGS:start_month "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: vCounter "url" SQL Injection Vulnerability
SecRule REQUEST_URI "vCounter\.php" "chain,id:390021,rev:1,severity:2,msg:'JITP: Oxygen SQL Injection'"
SecRule ARGS:url "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PHP Classifieds "searchword" Cross-Site Scripting Vulnerability
SecRule REQUEST_URI "search\.php" "chain,id:390022,rev:1,severity:2,msg:'JITP: Mantis XSS attack'"
SecRule ARGS:searchword "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: PHPCollab v2.x / NetOffice v2.x sendpassword.php SQL Injection
SecRule REQUEST_URI "/sendpassword\.php\?action=send" "chain,id:390023,rev:1,severity:2,msg:'JITP: PHPCollab v2.x / NetOffice v2.x sendpassword.php SQL Injection'"
SecRule REQUEST_BODY "UNION SELECT.*concat.*password.*admin\.php"

# Rule 310019: Sourceworkshop newsletter "email" SQL Injection Vulnerability
SecRule REQUEST_URI "/newsletter\.php" "chain,id:390024,rev:1,severity:2,msg:'JITP: Sourceworkshop newsletter SQL Injection Vulnerability'"
SecRule ARGS:newsletteremail "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: X-Changer SQL Injection Vulnerabilities
SecRule REQUEST_URI "/index\.php" "chain,id:390025,rev:1,severity:2,msg:'JITP: X-Changer SQL Injection Vulnerability'"
SecRule ARGS:from|ARGS:into|ARGS:id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Cholod Mysql based message board Script Insertion and SQL Injection
SecRule REQUEST_URI "/mb\.cgi" "chain,id:390025,rev:1,severity:2,msg:'JITP: X-Changer SQL Injection Vulnerability'"
SecRule ARGS:topicnumber|ARGS:threadnumber "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Cholod Mysql based message board Script Insertion and SQL Injection
SecRule REQUEST_URI "/mb\.cgi" "chain,id:390026,rev:1,severity:2,msg:'JITP: X-Changer XSS Vulnerability'"
SecRule ARGS:Name|ARGS:Subject|ARGS:Message "(?:(?:javascript|script|about|applet|activex|chrome)*\>|html|(?:http|https|ftp)\:/)"

# Rule 310019: Null news Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/(?:sub|unsub)\.php" "chain,id:390027,rev:1,severity:2,msg:'JITP: Null news Multiple SQL Injection Vulnerabilities'"
SecRule ARGS:user_username "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Null news Multiple SQL Injection Vulnerabilities
SecRule REQUEST_URI "/lostpass\.php" "chain,id:390028,rev:1,severity:2,msg:'JITP: Null news Multiple SQL Injection Vulnerabilities'"
SecRule ARGS:user_email "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: VSNS Lemon SQL injection Vulnerabilities
SecRule REQUEST_URI "/functions/final_functions\.php" "chain,id:390029,rev:1,severity:2,msg:'JITP: Null news Multiple SQL Injection Vulnerabilities'"
SecRule ARGS:id "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: PHPLiveHelper 1.8 remote command execution Xploit
SecRule REQUEST_URI "initiate\.php" "chain,id:390030,rev:1,severity:2,msg:'JITP: PHPLiveHelper 1.8 remote command execution Xploit'"
SecRule ARGS:abs_path "(?:http|https|ftp)\:/"

# Rule 310019: Pixel Motion Blog SQL Injection Vulnerabilities
SecRule REQUEST_URI "admin/index\.php" "chain,id:390031,rev:1,severity:2,msg:'JITP: Pixel Motion Blog SQL Injection Vulnerabilities'"
SecRule ARGS:user|ARGS:pass "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Pixel Motion Blog SQL Injection Vulnerabilities
SecRule REQUEST_URI "index\.php" "chain,id:390032,rev:1,severity:2,msg:'JITP: Pixel Motion Blog SQL Injection Vulnerabilities'"
SecRule ARGS:date "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Nuked-Klan "m" SQL Injection Vulnerability
SecRule REQUEST_URI "index\.php" "chain,id:390033,rev:1,severity:2,msg:'JITP: Nuked-Klan SQL Injection Vulnerability'"
SecRule ARGS:m "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: TFT Gallery "passwd" Exposure of User Credentials
SecRule REQUEST_URI "admin/passwd$" "id:390035,rev:1,severity:2,msg:'JITP: TFT Gallery passwd Exposure of User Credentials'"

# Rule 310019: PHP Ticket "frm_search_in" SQL Injection Vulnerability
SecRule REQUEST_URI "search\.php" "chain,id:390036,rev:1,severity:2,msg:'JITP: Nuked-Klan SQL Injection Vulnerability'"
SecRule ARGS:frm_search_in "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: WEBalbum Local File Inclusion Vulnerability
SecRule REQUEST_COOKIES:skin2 "\.\." "id:390037,rev:1,severity:2,msg:'JITP: WEBalbum Local File Inclusion Vulnerability'"

# Rule 310019: G-Book "g_message" Script Insertion Vulnerability
SecRule REQUEST_URI "/guestbook\.php" "chain,id:390038,rev:1,severity:2,msg:'JITP: G-Book g_message Script Insertion Vulnerability'"
SecRule ARGS:g_message "((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"

# Rule 310019: PHPMyChat exploit
SecRule REQUEST_URI "messagesL\.php.?\?L=.*R=.*N=.*&T=.*cmd=" "id:390039,rev:1,severity:2,msg:'JITP: PHPMyChat exploit'"

# Rule 310019: Horde Help Module Remote Execution
SecRule REQUEST_URI "/services/help/\?show=.*&module=;\"" "id:390040,rev:1,severity:2,msg:'JITP: Horde Help Module Remote Execution'"

# Rule 310019: Internet PhotoShow Remote File Inclusion Exploit
SecRule REQUEST_URI "index\.php?page=(ht|f)tps?:/.*\?&[a-z]+=[a-z]" "id:390041,rev:1,severity:2,msg:'JITP: Internet PhotoShow Remote File Inclusion Exploit'"

# Rule 310019: Censtore.cgi exploit
SecRule REQUEST_URI "/censtore\.cgi\?page=\|" "id:390042,rev:1,severity:2,msg:'JITP: Censtore.cgi exploit'"

# Rule 310019: quizz.pl exploit
SecRule REQUEST_URI "quizz\.pl/ask/\;" "id:390043,rev:1,severity:2,msg:'JITP: quizz.pl exploit'"

# Rule 310019: phpinfo.cgi command execution
SecRule REQUEST_URI "/phpinfo\.php\?cmd=" "id:390044,rev:1,severity:2,msg:'JITP: phpinfo.cgi command execution'"

# Rule 310019: phpRaid "phpbb_root_path" File Inclusion Vulnerability
SecRule REQUEST_URI "auth/auth_phpbb\.php" "chain,id:390045,rev:1,severity:2,msg:'JITP: phpRaid phpbb_root_path File Inclusion Vulnerability'"
SecRule ARGS:phpbb_root_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: openEngine "template" Parameter Local File Inclusion Vulnerability
SecRule REQUEST_URI "website\.php" "chain,id:390046,rev:1,severity:2,msg:'JITP: openEngine template Parameter Local File Inclusion Vulnerability'"
SecRule ARGS:template "\.\./\.\."

# Rule 310019: ISPConfig "go_info[server][classes_root]" File Inclusion
SecRule REQUEST_URI "lib/session\.inc\.php" "chain,id:390047,rev:1,severity:2,msg:'JITP: ISPConfig go_info[server][classes_root] File Inclusion'"
SecRule REQUEST_URI "go_info\[server\]\[classes_root\].*((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: ManageEngine OpManager "searchTerm" Cross-Site Scripting
SecRule  REQUEST_URI "search\.do" "chain,id:390048,rev:1,severity:2,msg:'JITP: ManageEngine OpManager searchTerm Cross-Site Scripting'"
SecRule ARGS:searchTerm "(javascript|script|about|applet|activex|chrome)*\>"

# Rule 310019: AliPAGER "ubild" Cross-Site Scripting and SQL Injection
SecRule  REQUEST_URI "inc/elementz\.php" "chain,id:390049,rev:1,severity:2,msg:'JITP: AliPAGER ubild Cross-Site Scripting and SQL Injection'"
SecRule ARGS:ubild "((javascript|script|about|applet|activex|chrome)*\>|((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM))"

# Rule 310019: MxBB Portal pafileDB Module "module_root_path" File Inclusion
SecRule  REQUEST_URI "includes/pafiledb_constants\.php" "chain,id:390050,rev:1,severity:2,msg:'JITP: MxBB Portal pafileDB Module module_root_path File Inclusion'"
SecRule ARGS:module_root_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Jadu CMS "register.php" Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "site/scripts/register\.php" "chain,id:390051,rev:1,severity:2,msg:'JITP: Jadu CMS register.php Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:forename|ARGS:surname|ARGS:reg_email|ARGS:email_conf|ARGS:company|ARGS:city|ARGS:postcode|ARGS:telephone "(javascript|script|about|applet|activex|chrome|php)*\>"

# Rule 310019: OpenFAQ "q" Parameter Script Insertion Vulnerability
SecRule  REQUEST_URI "search\.php" "chain,id:390052,rev:1,severity:2,msg:'JITP: OpenFAQ q Parameter Script Insertion Vulnerability'"
SecRule ARGS:q "(javascript|script|about|applet|activex|chrome)*\>"

# Rule 310019: phpBB foing Module "phpbb_root_path" File Inclusion
SecRule  REQUEST_URI "(index|faq|song|list|gen_m3u|playlist)\.php" "chain,id:390053,rev:1,severity:2,msg:'JITP: phpBB foing Module phpbb_root_path File Inclusion'"
SecRule ARGS:phpbb_root_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Sugar Suite "sugarEntry" Parameter Security Bypass
SecRule  REQUEST_URI "/modules/.*/.*\.php\?GLOBALS\[sugarEntry\].*((ht|f)tps?:/|\.\./\.\.)" "id:390054,rev:1,severity:2,msg:'JITP: Sugar Suite sugarEntry Parameter Security Bypass'"
# Rule 310019: Sugar Suite "sugarEntry" Parameter Security Bypass
SecRule  REQUEST_URI "/modules/.*/.*\.php\?cmd=.*GLOBALS\[sugarEntry\].*((ht|f)tps?:/|\.\./\.\.)" "id:390055,rev:1,severity:2,msg:'JITP: Sugar Suite sugarEntry Parameter Security Bypass'"
# Rule 310019: Sugar Suite "sugarEntry" Parameter Security Bypass
SecRule  REQUEST_URI "/modules/.*/.*\.php" "chain,id:390056,rev:1,severity:2,msg:'JITP: Sugar Suite sugarEntry Parameter Security Bypass'"
SecRule  REQUEST_BODY|REQUEST_URI "\?GLOBALS\[sugarEntry\].*((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Sugar Suite exploit
SecRule  REQUEST_URI "modules/Administration/RebuildAudit\.php\?cmd=" "id:390057,rev:1,severity:2,msg:'JITP: Sugar Suite exploit'"

# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-lastchanges\.php" "chain,id:390058,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:days|ARGS:offset "(javascript|script|about|applet|activex|chrome)+.?\>"
# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-orphan_pages\.php" "chain,id:390059,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:find "(javascript|script|about|applet|activex|chrome)+.?\>"
# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-listpages\.php" "chain,id:390060,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:offset|ARGS:initial "(javascript|script|about|applet|activex|chrome)+.?\>"
# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-remind_password\.php" "chain,id:390061,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:username "(javascript|script|about|applet|activex|chrome)+.?\>"
# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-(admin_(rssmodules|notifications|content_templates|chat)|syslog)\.php" "chain,id:390062,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:offset "(javascript|script|about|applet|activex|chrome)+.?\>"
# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-adminusers\.php" "chain,id:390063,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:numrows "(javascript|script|about|applet|activex|chrome)+.?\>"
# Rule 310019: TikiWiki Multiple Cross-Site Scripting Vulnerabilities
SecRule  REQUEST_URI "tiki-searchindex\.php" "chain,id:390095,rev:1,severity:2,msg:'JITP: TikiWiki Multiple Cross-Site Scripting Vulnerabilities'"
SecRule ARGS:highlist "(javascript|script|about|applet|activex|chrome)+.?\>"

# Rule 310019: Wordpress shell injection Vulnerability
SecRule  REQUEST_URI "/cache/user.*/.*\.php\?cmd=" "id:390064,rev:1,severity:2,msg:'JITP: Wordpress shell injection Vulnerability'"

# Rule 310019: Nucleus <= 3.22 arbitrary remote inclusion exploit
SecRule  REQUEST_URI "PLUGINADMIN\.php\?GLOBALS\[DIR_LIBS\]=((ht|f)tps?\:/|/tmp|/opt|/etc|/export|/var|/home|/usr|\.\.)" "id:390065,rev:1,severity:2,msg:'JITP: Nucleus arbitrary remote inclusion exploit'"

# Rule 310019: Horde passthru protection
SecRule REQUEST_URI "/services/help(/)?\?(.*)?\&module=.*passthru\(.*\)" "id:390066,rev:1,severity:2,msg:'JITP: Horde passthru exploit'"

# Rule 310019: CMS-Bandits "spaw_root" File Inclusion Vulnerabilities
SecRule REQUEST_URI "dialogs/(img|td|table)\.php" "chain,id:390067,rev:2,severity:2,msg:'JITP: CMS-Bandits spaw_root File Inclusion Vulnerability'"
SecRule ARGS:spaw_root "(ht|f)tps?\:/"

# Rule 310019: phpBB Blend Portal System Module "phpbb_root_path" File Inclusion
SecRule REQUEST_URI "dialogs/(img|td)\.php" "chain,id:390068,rev:1,severity:2,msg:'JITP: phpBB Blend Portal System Module phpbb_root_path File Inclusion'"
SecRule ARGS:phpbb_root_path "(ht|f)tps?\:/"

# Rule 310019: Admanager Pro exploit
SecRule REQUEST_URI "common\.php" "chain,id:390069,rev:1,severity:2,msg:'JITP: Admanager Pro exploit'"
SecRule ARGS:ipath "((ht|f)tps?\:/|\.\./)"

# Rule 310019: Bible Portal Project destination File Inclusion Vulnerability'
SecRule REQUEST_URI "Admin/rtf_parser\.php" "chain,id:390071,rev:1,severity:2,msg:'JITP: Bible Portal Project destination File Inclusion Vulnerability'"
SecRule ARGS:destination "((ht|f)tps?\:/|\.\./)"

# Rule 310019: Flipper Poll "root_path" File Inclusion Vulnerability
SecRule REQUEST_URI "poll\.php" "chain,id:390072,rev:1,severity:2,msg:'JITP: Flipper Poll root_path File Inclusion Vulnerability'"
SecRule ARGS:root_path "((ht|f)tps?\:/|\.\./)"

# Rule 310019: PictureDis Products "lang" Parameter File Inclusion Vulnerability
SecRule REQUEST_URI "(thumstbl|wpfiles|wallpapr)\.php" "chain,id:390073,rev:1,severity:2,msg:'JITP: PictureDis Products lang Parameter File Inclusion Vulnerability'"
SecRule ARGS:lang "((ht|f)tps?\:/|\.\./)"

# Rule 310019: Joomla and Mambo 'Weblinks' blind SQL injection / admin credentials EXPLOIT
SecRule REQUEST_URI "index\.php" "chain,id:390074,rev:1,severity:2,msg:'JITP: Joomla/Mambo Weblinks blind SQL injection'"
SecRule ARGS:title "(users[[:space:]]+WHERE[[:space:]]+usertype|UNION[[:space:]]+SELECT[[:space:]]+IF|insert[[:space:]]+into.+values|select.+from|bulk[[:space:]]+insert|union.+select)" chain
SecRule ARGS:task "save"

# Rule 310019: new pattern
SecRule REQUEST_URI "index\.php\?mod=files&action=view&where=-1+UNION+SELECT+users_nick,0,users_pwd"

# Rule 310019: phpBB Mail2Forum Module "m2f_root_path" File Inclusion
SecRule ARGS:m2f_root_path "((ht|f)tps?\:/|\.\./)" "id:390076,rev:1,severity:2,msg:'JITP: Generic m2f_root_path File Inclusion Vulnerability'"

# Rule 310019: 
SecRule REQUEST_URI "downloads\.php" "chain,id:390077,rev:1,severity:2,msg:'JITP: Generic PHP download incddir File Inclusion Vulnerability'"
SecRule ARGS:incdir "((ht|f)tps?\:/|\.\./)"

# Rule 310019: SiteDepth CMS "SD_DIR" Parameter Handling Remote File Inclusion Vulnerability
SecRule REQUEST_URI "constants\.php" "chain,id:390078,rev:1,severity:2,msg:'JITP: SiteDepth CMS SD_DIR Parameter Handling Remote File Inclusion Vulnerability'"
SecRule ARGS:SD_DIR "((ht|f)tps?\:/|\.\./)"

# Rule 310019: PhpLinkExchange "page" Parameter Handling Remote File Inclusion Vulnerability
SecRule REQUEST_URI "index\.php" "chain,id:390079,rev:1,severity:2,msg:'JITP: PhpLinkExchange page Parameter Handling Remote File Inclusion Vulnerability'"
SecRule ARGS:page "((ht|f)tps?\:/|\.\./)"

# Rule 310019: test for valid X-forearded header
SecRule REQUEST_HEADERS:X_FORWARDED_FOR "!^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|)|unknown),?(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|)|unknown)?" "id:390080,rev:1,severity:2,msg:'Test: Checking for valid X-Forwarded header',log,pass"

# Rule 310019: authldap 
SecRule REQUEST_URI "authldap\.php" "chain,id:390081,rev:1,severity:2,msg:'JITP: authldap Remote File Inclusion Vulnerability'"
SecRule ARGS:includePath "((ht|f)tps?\:/|\.\./)"

# Rule 310019: honeypot
SecRule REQUEST_URI "global_header\.php" "chain,id:390082,rev:1,severity:2,msg:'JITP: globalheader domain variable Remote File Inclusion Vulnerability'"
SecRule ARGS:domain "((ht|f)tps?\:/|\.\./)"

# Rule 310019: Generic phpbb_root_path inclusion
SecRule ARGS:phpbb_root_path "((ht|f)tps?:/|\.\./\.\.)" "id:390083,rev:1,severity:2,msg:'JITP: Generic phpbb_root_path variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic BBCodeFile variable remote file include
SecRule ARGS:BBCodeFile "((ht|f)tps?:/|\.\./\.\.)" "id:390084,rev:1,severity:2,msg:'JITP: Generic BBCodeFile variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic wb_class_dir variable remote file include
SecRule ARGS:wb_class_dir "((ht|f)tps?:/|\.\./\.\.)" "id:390085,rev:1,severity:2,msg:'JITP: Generic wb_class_dir variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic component_dir variable remote file include
SecRule ARGS:component_dir "((ht|f)tps?:/|\.\./\.\.)" "id:390086,rev:1,severity:2,msg:'JITP: Generic component_dir variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic da_path variable remote file include
SecRule ARGS:da_path "((ht|f)tps?:/|\.\./\.\.)" "id:390087,rev:1,severity:2,msg:'JITP: Generic da_path variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic spaw_root variable remote file include
SecRule ARGS:spaw_root "((ht|f)tps?:/|\.\./\.\.)" "id:390088,rev:1,severity:2,msg:'JITP: Generic spaw_root variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic sitee variable remote file include
SecRule ARGS:sitee "((ht|f)tps?:/|\.\./\.\.)" "id:390089,rev:1,severity:2,msg:'JITP: Generic sitee variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic default_path variable remote file include
SecRule REQUEST_URI "\.php" "chain,id:390092,rev:1,severity:2,msg:'JITP: PHP default_path variable Remote File Inclusion Vulnerability'"
SecRule ARGS:default_path "((ht|f)tps?:/|\.\./\.\.)" 

# Rule 310019: file_upload sbp remote file inclusion vuln
SecRule REQUEST_URI "file_upload\.php" "chain,id:390090,rev:1,severity:2,msg:'JITP: file_upload sbp variable Remote File Inclusion Vulnerability'"
SecRule ARGS:sbp "((ht|f)tps?\:/|\.\./)"

# Rule 310019: viewtopic sid remote file inclusion vuln
SecRule REQUEST_URI "viewtopic\.php" "chain,id:390091,rev:1,severity:2,msg:'JITP: viewtopic sid variable Remote File Inclusion Vulnerability'"
SecRule ARGS:sid "((ht|f)tps?\:/|\.\./)"

# Rule 310019: get_infochannel root_path remote file inclusion vuln
SecRule REQUEST_URI "get_infochannel\.inc\.php" "chain,id:390093,rev:1,severity:2,msg:'JITP: get_infochannel root_path variable Remote File Inclusion Vulnerability'"
SecRule ARGS:root_path "((ht|f)tps?\:/|\.\./)"

# Rule 310019: Generic root_path variable remote file include
SecRule ARGS:root_path "((ht|f)tps?:/|\.\./\.\.)" "id:390094,rev:1,severity:2,msg:'JITP: Generic root_path variable Remote File Inclusion Vulnerability'"

# Rule 310019: Generic default_path variable remote file include
SecRule REQUEST_URI "\.php" "chain,id:390096,rev:1,severity:2,msg:'JITP: PHP glConf variable Remote File Inclusion Vulnerability'"
SecRule REQUEST_URI "glConf\[path_library\].*((ht|f)tps?:/|\.\./\.\.)" 

# Rule 310019: MyNewsGroups :) "myng_root" File Inclusion Vulnerability
SecRule REQUEST_URI "layersmenu\.inc\.php" "chain,id:390097,rev:1,severity:2,msg:'JITP: MyNewsGroups myng_root Remote File Inclusion Vulnerability'"
SecRule ARGS:myng_root "((ht|f)tps?:/|\.\./\.\.)" 

# Rule 310019: Joomla invalid arguments check
#SecRule "joomla/" "chain,id:390098,rev:1,severity:2,msg:'JITP: Joomla invalid character Vulnerability'"
#SecRule ARGS:from|ARGS:fromname|ARGS:subject "[\x00-\x1F\x7F]" 

# Rule 310019: TikiWiki jhot.php upload exploit
SecRule REQUEST_URI  "img/wiki/"  "chain,id:390099,rev:1,severity:2,msg:'JITP: TikiWiki non-image upload exploit'"
SecRule REQUEST_URI  "\.!(jpe?g|gif|png|bmp)" 

# Rule 310019: pageheaderdefault sysSessionPath upload exploit
SecRule REQUEST_URI  "pageheaderdefault\.inc\.php\?" "chain,id:390100,rev:1,severity:2,msg:'JITP: pageheaderdefault sysSessionPath upload exploit'"
SecRule REQUEST_URI  "_sysSessionPath=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: new pattern
SecRule REQUEST_URI "\.php\?" "chain,id:390101,rev:1,severity:2,msg:'JITP: possible vulnscan6 exploit'"
SecRule REQUEST_URI "(CONFIG_EXT\[LANGUAGES_DIR\]|dir\[inc\])=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Socketwiz Bookmarks "root_dir" File Inclusion Vulnerability
SecRule REQUEST_URI "smarty_config\.php" "chain,id:390102,rev:1,severity:2,msg:'JITP: Socketwiz Bookmarks root_dir File Inclusion Vulnerability'"
SecRule ARGS:root_dir "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: MyABraCaDaWeb "base" File Inclusion Vulnerabilities
SecRule REQUEST_URI "(index|pop)\.php" "chain,id:390103,rev:1,severity:2,msg:'JITP: MyABraCaDaWeb base File Inclusion Vulnerabilities'"
SecRule ARGS:base "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Vivvo Article Management CMS SQL Injection and File Inclusion
SecRule REQUEST_URI "pdf_version\.php" "chain,id:390104,rev:1,severity:2,msg:'JITP: Vivvo Article Management CMS SQL Injection'"
SecRule ARGS:id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: Vivvo Article Management classified_path file inclusion
SecRule ARGS:classified_path "((ht|f)tps?:/|\.\./\.\.)" "id:390105,rev:1,severity:2,msg:'JITP: Vivvo Article Management CMS File Inclusion'"

# Rule 310019: RaidenHTTPD "SoftParserFileXml" File Inclusion Vulnerability
SecRule REQUEST_URI "raidenhttpd-admin/slice/check\.php" "chain,id:390106,rev:1,severity:2,msg:'JITP: RaidenHTTPD SoftParserFileXml File Inclusion Vulnerability'"
SecRule ARGS:SoftParserFileXml "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: mcGalleryPRO "path_to_folder" File Inclusion Vulnerability
SecRule REQUEST_URI "random2\.php" "chain,id:390107,rev:1,severity:2,msg:'JITP: mcGalleryPRO path_to_folder File Inclusion Vulnerability'"
SecRule ARGS:path_to_folder "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Timesheet PHP "username" Parameter SQL Injection
SecRule REQUEST_URI "username\.php" "chain,id:390108,rev:1,severity:2,msg:'JITP: Timesheet PHP username Parameter SQL Injection'"
SecRule ARGS:username "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

# Rule 310019: CCleague Pro "language" Parameter Local File Inclusion
SecRule ARGS:language "((ht|f)tps?:/|\.\./\.\.)" "id:390109,rev:1,severity:2,msg:'JITP: CCleague Pro language Parameter Local File Inclusion'"

# Rule 310019: TWiki "filename" Parameter Disclosure of Sensitive Information
SecRule REQUEST_URI "/TWiki/" "chain,id:390110,rev:1,severity:2,msg:'JITP: TWiki filename Parameter Disclosure of Sensitive Information'"
SecRule ARGS:filename "\.\./\.\."

# Rule 310019: photokorn "dir_path" File Inclusion Vulnerabilities
SecRule REQUEST_URI "(includes/cart\.inc\.php|extras/ext_cat\.php)" "chain,id:390111,rev:1,severity:2,msg:'JITP: photokorn dir_path File Inclusion Vulnerabilities'"
SecRule ARGS:dir_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Somery "skindir" File Inclusion Vulnerability
SecRule REQUEST_URI "admin/system/include\.php" "chain,id:390112,rev:1,severity:2,msg:'JITP: Somery skindir File Inclusion Vulnerability'"
SecRule ARGS:skindir "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: DokuWiki "TARGET_FN" Directory Traversal Vulnerability
SecRule REQUEST_URI "bin/dwpage\.php" "chain,id:390113,rev:1,severity:2,msg:'JITP: DokuWiki TARGET_FN Directory Traversal Vulnerability'"
SecRule ARGS:TARGET_FN "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Fantastic News "CONFIG[script_path]" File Inclusion Vulnerabilities
SecRule REQUEST_URI "(archive|headlines)\.php" "chain,id:390114,rev:1,severity:2,msg:'JITP: Fantastic News CONFIG[script_path] File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "CONFIG\[script_path\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: BP News "bnrep" File Inclusion Vulnerability
SecRule REQUEST_URI "bp_ncom\.php" "chain,id:390115,rev:1,severity:2,msg:'JITP: BP News bnrep File Inclusion Vulnerability'"
SecRule ARGS:bnrep "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Akarru Social BookMarking Engine "bm_content" File Inclusion
SecRule REQUEST_URI "akarru\.gui/main_content\.php" "chain,id:390116,rev:1,severity:2,msg:'JITP: Akarru Social BookMarking Engine bm_content File Inclusion'"
SecRule ARGS:bm_content "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Beautifier "BEAUT_PATH" Parameter File Inclusion Vulnerability
#phpCodeGenie "BEAUT_PATH" File Inclusion Vulnerability
SecRule REQUEST_URI "Beautifier/Core\.php" "chain,id:390117,rev:1,severity:2,msg:'JITP: Beautifier BEAUT_PATH Parameter File Inclusion Vulnerability'"
SecRule ARGS:BEAUT_PATH "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: phpFullAnnu "repmod" File Inclusion Vulnerability
SecRule REQUEST_URI "modules/home\.module\.php" "chain,id:390118,rev:1,severity:2,msg:'JITP: phpFullAnnu repmod File Inclusion Vulnerability'"
SecRule ARGS:repmod "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Sponge News "sndir" File Inclusion Vulnerability
SecRule REQUEST_URI "news\.php" "chain,id:390119,rev:1,severity:2,msg:'JITP: Sponge News sndir File Inclusion Vulnerability'"
SecRule ARGS:sndir "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: ACGV News "PathNews" File Inclusion Vulnerabilities
SecRule REQUEST_URI "\.php\?" "chain,id:390120,rev:1,severity:2,msg:'JITP: ACGV News PathNews File Inclusion Vulnerabilities'"
SecRule ARGS:PathNews "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: MySpeach "my_ms[root]" Parameter File Inclusion Vulnerability
SecRule REQUEST_URI "jscript\.php\?" "chain,id:390121,rev:1,severity:2,msg:'JITP: MySpeach my_ms[root] Parameter File Inclusion Vulnerability'"
SecRule REQUEST_URI "my_ms\[root\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: annoncesV "page" Parameter File Inclusion Vulnerability
SecRule REQUEST_URI "annonce\.php\?" "chain,id:390122,rev:1,severity:2,msg:'JITP: annoncesV page Parameter File Inclusion Vulnerability'"
SecRule ARGS:page "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: GrapAgenda "page" File Inclusion Vulnerability
SecRule REQUEST_URI "index\.php\?" "chain,id:390123,rev:1,severity:2,msg:'JITP: GrapAgenda page File Inclusion Vulnerability'"
SecRule ARGS:page "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: C-News "path" File Inclusion Vulnerabilities
SecRule REQUEST_URI "/affichage/.*\.php\?" "chain,id:390124,rev:1,severity:2,msg:'JITP: C-News path File Inclusion Vulnerabilities'"
SecRule ARGS:path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: PhpCommander "Directory" Local File Inclusion Vulnerability
SecRule REQUEST_URI "download\.php\?" "chain,id:390125,rev:1,severity:2,msg:'JITP: PhpCommander Directory Local File Inclusion Vulnerability'"
SecRule ARGS:Directory "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: dyncms "x_admindir" File Inclusion Vulnerability
SecRule REQUEST_URI "0_admin/modules/Wochenkarte/frontend/index\.php" "chain,id:390126,rev:1,severity:2,msg:'JITP: dyncms x_admindir File Inclusion Vulnerability'"
SecRule ARGS:x_admindir "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: MyBace Light Skript File Inclusion Vulnerabilities
SecRule REQUEST_URI "includes/login_check\.php" "chain,id:390127,rev:1,severity:2,msg:'JITP: MyBace Light Skript File Inclusion Vulnerabilities'"
SecRule ARGS:hauptverzeichniss "((ht|f)tps?:/|\.\./\.\.)"
# Rule 310019: MyBace Light Skript File Inclusion Vulnerabilities
SecRule REQUEST_URI "dmin/login/content/user_daten\.php" "chain,id:390128,rev:1,severity:2,msg:'JITP: MyBace Light Skript File Inclusion Vulnerabilities'"
SecRule ARGS:template_back "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: YACS "context[path_to_root]" File Inclusion Vulnerabilities
SecRule REQUEST_URI "\.php" "chain,id:390129,rev:1,severity:2,msg:'JITP: YACS context[path_to_root] File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "context\[path_to_root\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Pheap "lpref" File Inclusion Vulnerability
SecRule REQUEST_URI "lib/config\.php" "chain,id:390130,rev:1,severity:2,msg:'JITP: Pheap lpref File Inclusion Vulnerability'"
SecRule ARGS:lpref "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: phpECard "include_path" File Inclusion Vulnerabilities
SecRule REQUEST_URI "functions\.php" "chain,id:390131,rev:1,severity:2,msg:'JITP: phpECard include_path File Inclusion Vulnerabilities'"
SecRule ARGS:include_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: MiniBill "config[include_dir]" Parameter File Inclusion
SecRule REQUEST_URI "actions/ipn\.php" "chain,id:390132,rev:1,severity:2,msg:'JITP: MiniBill config[include_dir] File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "config\[include_dir\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: phpGroupWare Local File Inclusion Vulnerability
SecRule REQUEST_URI "alendar/inc/class.holidaycalc\.inc\.php" "chain,id:390133,rev:1,severity:2,msg:'JITP: phpGroupWare Local File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "phpgw_info\[user\]\[preferences\]\[common\]\[country\]=\.\./\.\."

# Rule 310019: ExBB Italia "exbb[home_path]" File Inclusion Vulnerability
SecRule REQUEST_URI "modules/userstop/userstop\.php" "chain,id:390134,rev:1,severity:2,msg:'JITP: ExBB Italia exbb[home_path] File Inclusion Vulnerability'"
SecRule REQUEST_URI "exbb\[home_path\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Web3news "PHPSECURITYADMIN_PATH" File Inclusion
SecRule REQUEST_URI "security/include/_class\.security\.php" "chain,id:390135,rev:1,severity:2,msg:'JITP: Web3news PHPSECURITYADMIN_PATH File Inclusion Vulnerabilities'"
SecRule ARGS:PHPSECURITYADMIN_PATH "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: phpCOIN "_CCFG[_PKG_PATH_INCL]" File Inclusion
SecRule REQUEST_URI "\.php\?" "chain,id:390136,rev:1,severity:2,msg:'JITP: phpCOIN _CCFG[_PKG_PATH_INCL] File Inclusion'"
SecRule REQUEST_URI "_CCFG\[_PKG_PATH_INCL\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Wikepage "lng" Local File Inclusion Vulnerability
SecRule REQUEST_URI "index\.php" "chain,id:390137,rev:1,severity:2,msg:'JITP: Wikepage lng Local File Inclusion Vulnerability'"
SecRule ARGS:lng "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Empire CMS "check_path" File Inclusion Vulnerability
SecRule REQUEST_URI "e/class/CheckLevel\.php" "chain,id:390138,rev:1,severity:2,msg:'JITP: Empire CMS check_path File Inclusion Vulnerability'"
SecRule ARGS:check_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Dolphin "dir[inc]" File Inclusion Vulnerability
SecRule REQUEST_URI "templates/tmpl_dfl/scripts/index.php" "chain,id:390139,rev:1,severity:2,msg:'JITP: Dolphin dir[inc] File Inclusion Vulnerability'"
SecRule REQUEST_URI "dir\[inc\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: SportsPHool "mainnav" File Inclusion Vulnerability
SecRule REQUEST_URI "includes/layout/plain\.footer\.php" "chain,id:390140,rev:1,severity:2,msg:'JITP: SportsPHool mainnav File Inclusion Vulnerability'"
SecRule ARGS:mainnav "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: NES Game & NES System "phphtmllib" File Inclusion
SecRule REQUEST_URI "\.php\?" "chain,id:390141,rev:1,severity:2,msg:'JITP: NES Game & NES System phphtmllib File Inclusion'"
SecRule ARGS:phphtmllib "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: PHlyMail Lite "_PM_[path][handler]" File Inclusion Vulnerability
SecRule REQUEST_URI "handlers/email/mod.listmail.php" "chain,id:390142,rev:1,severity:2,msg:'JITP: PHlyMail Lite _PM_[path][handler] File Inclusion Vulnerability'"
SecRule REQUEST_URI "_PM_\[path\]\[handler\]=((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Sonium Enterprise Adressbook "folder" File Inclusion Vulnerabilities
SecRule REQUEST_URI "/plugins/(1_Adressbuch/new|2_Branchen/edit|3_Typ/delete)\.php\?" "chain,id:390143,rev:1,severity:2,msg:'JITP: Sonium Enterprise Adressbook folder File Inclusion Vulnerabilities'"
SecRule ARGS:folder "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: ff_compath remote file inclusion
SecRule ARGS:ff_compath "((ht|f)tps?:/|\.\./\.\.)" "id:390150,rev:1,severity:2,msg:'JITP: ff_compath File Inclusion Vulnerabilities'"

# Rule 310019: phpBB "avatar_path" PHP Code Execution Vulnerability
SecRule REQUEST_URI "/admin/admin_board\.php\?" "chain,id:390151,rev:1,severity:2,msg:'JITP: phpBB avatar_path PHP Code Execution Vulnerability'"
SecRule ARGS:avatar_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: phpMyProfiler "pmp_rel_path" File Inclusion Vulnerability
SecRule REQUEST_URI "/functions\.php\?" "chain,id:390152,rev:1,severity:2,msg:'JITP: phpMyProfiler pmp_rel_path File Inclusion Vulnerability'"
SecRule ARGS:pmp_rel_path "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Servlet auth attack
SecRule REQUEST_URI "/servlet/admin\?category=server\&method=listAll\&Authorization" "id:390153,rev:1,severity:2,msg:'JITP: Servlet Auth exposure Vulnerability'"

# Rule 310019: Eazy Cart Multiple Vulnerabilities
SecRule REQUEST_URI "easycart\.php" "chain,id:390154,rev:1,severity:2,msg:'JITP: Eazy Cart SQL injection'"
SecRule ARGS:price "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"
# Rule 310019: Eazy Cart Multiple Vulnerabilities
SecRule REQUEST_URI "admin/config/customer\.dat" "id:390155,rev:1,severity:2,msg:'JITP: Eazy Cart Customer Data Access'"
# Rule 310019: Eazy Cart Multiple Vulnerabilities
SecRule REQUEST_URI  "easycart\.php" "chain,id:390156,rev:1,severity:2,msg:'JITP: Eazy Cart XSS ATTACK'"
SecRule ARGS "<[[:space:]]*(script|about|applet|activex|chrome).*(script|about|applet|activex|chrome)[[:space:]]*>"

# Rule 310019: WebYep "webyep_sIncludePath" File Inclusion Vulnerabilities
SecRule REQUEST_URI "webyep-system/program/((lib|elements)/|webyep\.php)" "chain,id:390157,rev:1,severity:2,msg:'JITP: WebYep webyep_sIncludePath File Inclusion Vulnerabilities'"
SecRule ARGS:webyep_sIncludePath "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: Travelsized CMS "setup_folder" File Inclusion Vulnerability
SecRule REQUEST_URI "frontpage\.php" "chain,id:390158,rev:1,severity:2,msg:'JITP: Travelsized CMS setup_folder File Inclusion Vulnerabilities'"
SecRule ARGS:setup_folder "((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: VideoDB "config[pdf_module]" File Inclusion Vulnerability
SecRule REQUEST_URI "core/pdf\.php" "chain,id:390159,rev:1,severity:2,msg:'JITP: VideoDB File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "config\[pdf_module\].*((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: AllMyGuests "_AMGconfig[cfg_serverpath]" File Inclusion
SecRule REQUEST_URI "signin\.php" "chain,id:390160,rev:1,severity:2,msg:'JITP: AllMyGuests File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "_AMGconfig\[cfg_serverpath\].*((ht|f)tps?:/|\.\./\.\.)"

# Rule 310019: OpenBiblio Local File Inclusion and SQL Injection
SecRule REQUEST_URI "shared/(header|help)\.php" "chain,id:390161,rev:1,severity:2,msg:'JITP: OpenBiblio File Inclusion Vulnerabilities'"
SecRule ARGS "(((ht|f)tps?:/|\.\./\.\.)|((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM))"

# Rule 310019: BasiliX "BSX_LIBDIR" File Inclusion Vulnerabilities
SecRule REQUEST_URI "\.php" "chain,id:390162,rev:1,severity:2,msg:'JITP: BasiliX BSX_LIBDIR File Inclusion Vulnerabilities'"
SecRule ARGS:BSX_LIBDIR "((ht|f)tps?:/|\.\./\.\.)" 

# Rule 310019: PowerPortal "file_name[]" File Inclusion Vulnerability
SecRule REQUEST_URI "index\.php" "chain,id:390163,rev:2,severity:2,msg:'JITP: Powerportal File Inclusion Vulnerabilities'"
SecRule REQUEST_URI "file_name\[\].*(?:(ht|f)tps?:/|\.\./\.\.)" 

# Rule 310019: DeluxeBB "templatefolder" File Inclusion Vulnerability
SecRule REQUEST_URI "/templates/.*/.*/.*\.php" "chain,id:390164,rev:1,severity:2,msg:'JITP: DeluxeBB teplatefolder File Inclusion Vulnerabilities'"
SecRule ARGS:templatefolder "((ht|f)tps?:/|\.\./\.\.)" 

# Rule 310019: TagIt! Tagboard "page" File Inclusion Vulnerability
SecRule REQUEST_URI "/index\.php" "chain,id:390165,rev:1,severity:2,msg:'JITP: Tagit page File Inclusion Vulnerabilities'"
SecRule ARGS:page "(ht|f)tps?:/" 

#  Rule 310019: xcart exploit test
SecRule REQUEST_URI "xcart_dir=(ht|f)tps?:/" \
	"id:390166, rev:1, severity:2, msg:'JITP: xcart remote include'"

#  Rule 390167: amamber exploit
SecRule REQUEST_URI "/(?:linkpoint|config)\.inc\.php\?config\[root_dir\]=(ht|f)tps?:/" \
	"id:390167, rev:1, severity:2, msg:'JITP: amamber remote include'"

#e-Classifieds Corporate Edition "db" Cross-Site Scripting
SecRule REQUEST_URI "/hsx/classifieds\.hsx" \
	"chain,id:390168, rev:1, severity:2, msg:'JITP: e-Classifieds Corporate Edition db Cross-Site Scripting'"
SecRule ARGS:db "script"

#Xpoze "reed" SQL Injection Vulnerability
SecRule REQUEST_URI "account/user/mail\.html" \
	"chain,id:390169, rev:2, severity:2, msg:'JITP: Xpoze reed SQL Injection Vulnerability'"
SecRule ARGS:reed "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"


#LinPHA "maps_type" Local File Inclusion Vulnerability
SecRule REQUEST_URI "plugins/maps/map\.main\.class\.php" \
        "chain,id:390170, rev:1, severity:2, msg:'JITP: LinPHA maps_type Local File Inclusion Vulnerability'"
SecRule ARGS:maps_type "(?:\.\.|/etc)"

#Mole "viewsource.php" Information Disclosure Vulnerabilities
SecRule REQUEST_URI "viewsource\.php" \
        "chain,id:390171, rev:1, severity:2, msg:'JITP: Mole viewsource.php Information Disclosure Vulnerabilities'"
SecRule ARGS:dirn|ARGS:fname "(?:\.\.|/etc)"

#Aztech ADSL2/2+ 4 Port remote root 
SecRule REQUEST_URI "cgi-bin/script\?system &" \
       "t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:390172, rev:1, severity:2, msg:'JITP: Aztech ADSL2/2 remote root '"

#Index SQL in cat variable
SecRule REQUEST_URI "index\.php" \
        "t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,id:390173, rev:1, severity:2, msg:'JITP: index.php cat SQL injection'"
SecRule ARGS:cat "(?:\[|\;|\<|\>|\*|\||\'|\&|\$|\!|\?|\#|\(|\)|\[|\]|\{|\}|\:|\'|\"|\]|UNION(?:\+| )SELECT|wp_users|user_pass,CHAR)"

#Tikiwiki tiki-graph_formula.php f parameter Function Injection Vulnerability
SecRule REQUEST_FILENAME "tiki-graph_formula\.php" "chain,t:urlDecodeUni,t:lowercase,id:390174,rev:1, severity:2,msg:'JITP: Tikiwiki tiki-graph_formula.php f parameter Function Injection Vulnerability'"
SecRule ARGS_NAMES "^\s*f\[.*\]$"

# Tikiwiki tiki-graph_formula.php link inclusion attempt
SecRule REQUEST_FILENAME “tiki-graph_formula\.php” "chain,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:390175,rev:1, severity:2,msg:'JITP: Tikiwiki tiki-graph_formula.php link inclusion attempt'"
SecRule ARGS:/^\s*[a-z]+$/ "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

# Tikiwiki XSS in remind password field
SecRule REQUEST_METHOD "^post$" "chain,id:390176,rev:1, severity:2,msg:'JITP: Tikiwiki lost password XSS'"
SecRule REQUEST_FILENAME "tiki-remind_password\.php" chain
SecRule ARGS:username "!^(:?[a-z0-9\-\_]{1,37})$"

#Tikiwiki XSS in feastured link
SecRule REQUEST_URI "tiki-featured_link\.php" "chain,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:390177,rev:1,severity:2,msg:'JITP: TikiWiki featured link XSS attempt'"
SecRule ARGS:type "iframe" 

#Tikiwiki listpages mysql password disclosure attempt
SecRule REQUEST_URI "tiki-listpages\.php" "chain,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:390677,rev:1,severity:2,msg:'JITP: tikiwiki listpages mysql passwd disclosure attempt'"
SecRule ARGS:sort_mode "!^(pageName|hits|lastModif|creator|user|version|comment|flag|versions|links|backlinks|size)_(asc|desc)$" 

#Horde Webmail XSS
SecRule REQUEST_URI "addevent\.php" "chain,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390178,rev:1,severity:2,msg:'JITP: Horde Webmail XSS'"
SecRule ARGS:url "(?:script|iframe)"

#gCards 1.46 SQL
SecRule REQUEST_URI "getnewsitem\.php" "chain,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390179,rev:1,severity:2,msg:'JITP: gCards 1.46 SQL'"
SecRule ARGS:newsid "(?:gc_cardusers|union select|\(username|(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

#RedDot CMS SQL injection vulnerability
SecRule REQUEST_URI "iord\.asp" "chain,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390180,rev:1,severity:2,msg:'JITP: RedDot CMS SQL injection vulnerability'"
SecRule ARGS:Action "(?:io_dgc_eng|xtype=char|sysobjects|(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

#Joovili "category" SQL Injection Vulnerability
SecRule REQUEST_URI "browse\.videos\.php" "chain,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390181,rev:1,severity:2,msg:'JITP: Joovili category SQL injection vulnerability'"
SecRule ARGS:category "(?:joovili_(?:admins|users)|admin_(?:username|password)|id,username,password,email|(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

#Jokes Site Script "catagorie" SQL Injection Vulnerability
SecRule REQUEST_URI "jokes\.php" "chain,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390182,rev:1,severity:2,msg:'JITP: Jokes Script catagorie SQL injection vulnerability'"
SecRule ARGS:catagorie "(?:concat\(|(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

#WordPress Download Monitor Plugin "id" SQL Injection Vulnerability
SecRule REQUEST_URI "wp-download_monitor/download\.php" "chain,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390183,rev:1,severity:2,msg:'JITP: WordPress Download Monitor Plugin id SQL injection vulnerability'"
SecRule ARGS:id "(?:concat\(|(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*FROM)"

#Bits Listing Injection Vulnerability
SecRule REQUEST_URI "bits_listings\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390184,rev:1,severity:2,msg:'JITP: Bits Listing Injection vulnerability'"
SecRule ARGS:svr_rootPhpStart  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#sendreminders name injection
SecRule REQUEST_URI "(?:send_reminders|modules)\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390185,rev:2,severity:2,msg:'JITP: SendReminders Injection vulnerability'"
SecRule ARGS:name|ARGS:noSet  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#tikiprint injection
SecRule REQUEST_URI "tikiprint\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390186,rev:1,severity:2,msg:'JITP: tikiprint page Injection vulnerability'"
SecRule ARGS:page  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#up.php?my[root]
SecRule REQUEST_URI "/up\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390187,rev:1,severity:2,msg:'JITP: up.php my_root Injection vulnerability'"
SecRule ARGS:my[root]  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#Tikiwiki tiki-graph_formula.php path recursion vulnerability
SecRule REQUEST_URI "tiki-graph_formula\.php" "chain,t:urlDecodeUni,t:lowercase,id:390188,rev:1, severity:2,msg:'JITP: Tikiwiki tiki-graph_formula.php path recursion Vulnerability'"
SecRule ARGS "\.\./\.\."

#Tikiwiki tiki-read_article.php path recursion vulnerability
SecRule REQUEST_URI "tiki-(?:read_article|graph_formula)\.php" "chain,t:urlDecodeUni,t:lowercase,id:390189,rev:1, severity:2,msg:'JITP: Tikiwiki file access and injection Vulnerability'"
SecRule ARGS:title "(?:\.\./\.\.|(?:gopher|ogg|zlib|(?:ht|f)tps?\:/))"

#Force download injection
#force_download.php?file
SecRule REQUEST_URI "/force_download\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390190,rev:1,severity:2,msg:'JITP: ForceDownload file Injection vulnerability'"
SecRule ARGS:file  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#config.php?path_to_root
SecRule REQUEST_URI "/config\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390191,rev:1,severity:2,msg:'JITP: Config path_to_root Injection vulnerability'"
SecRule ARGS:path_to_root  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#search.php?exec
SecRule REQUEST_URI "/search\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390192,rev:1,severity:2,msg:'JITP: Search.php exec Injection vulnerability'"
SecRule ARGS:exec  "(?:gopher|ogg|zlib|(?:ht|f)tps?\:/)"

#join.html?jpage
SecRule REQUEST_URI "/join\.html" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390193,rev:1,severity:2,msg:'JITP: Join.html file inclusion vulnerability'"
SecRule ARGS:jpage  "(?:\.\./\.\.|/etc|(?:gopher|ogg|zlib|(?:ht|f)tps?\:/))"

#wp-download.php?dl_id SQL injection
SecRule REQUEST_URI "/wp-download\.php" "chain,t:base64Decode,t:hexDecode,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:390194,rev:1,severity:2,msg:'JITP: wp-download SQL injection vulnerability'"
SecRule ARGS  "wp_users"

#index.php menu_id SQL injection
SecRule REQUEST_URI "/index\.php" "chain,t:base64Decode,t:hexDecode,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:390195,rev:1,severity:2,msg:'JITP: index.php menu_id SQL injection vulnerability'"
SecRule ARGS:menu_id  "(?:wmp_admin|adminuser|adminpass)"

#links.asp CatID injection
SecRule REQUEST_URI "/links\.asp" "chain,t:base64Decode,t:hexDecode,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:390196,rev:1,severity:2,msg:'JITP: links.asp SQL injection vulnerability'"
SecRule ARGS:CatID  "(?:password|user_name|accesslevel)"

#class.admin_menu_lms.php?where_framework= injection
SecRule REQUEST_URI "/class\.admin_menu_lms\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390197,rev:1,severity:2,msg:'JITP: class.admin_menu_lms.php injection vulnerability'"
SecRule ARGS:where_framework  "(?:\.\./\.\.|/etc|(?:gopher|ogg|zlib|(?:ht|f)tps?\:/))"

#admin_frame.php?ltarget=/../../
SecRule REQUEST_URI "/admin_frame\.php" "chain,t:compressWhiteSpace,t:urlDecodeUni,t:lowercase,id:390198,rev:1,severity:2,msg:'JITP: admin_frame.php ltarget injection vulnerability'"
SecRule ARGS:ltarget  "(?:\.\./\.\.|/etc|(?:gopher|ogg|zlib|(?:ht|f)tps?\:/))"