Skip to content

False positives with 933160 PL1 PHP Injection Attack: High-Risk PHP Function Call Found #3931

@dune73

Description

@dune73

The quantitative testing project at the CRS dev retreat in Nov 2024 (https://github.com/coreruleset/coreruleset/wiki/Discussion-Quantitative-Testing) revealed some false positives on 933160.

Here is a custom text corpus with the payloads in question: custom-corpus-933160.txt

Here is how to run the corpus against the sandbox:

$ cat /tmp/custom-corpus-933160.txt | while read LINE; do PAYLOAD=$(echo $LINE | sed -e "s/^[^\t]*\t//"); echo ; echo $LINE; curl -H "x-format-output: txt-matched-rules" http://sandbox.coreruleset.org/ -d "payload=$PAYLOAD"; done

...

2 It used to be the administrative seat of the Bolewa people in the 16th century and of historical significance of Daniski hill today are the ruins of emirs’ palace, graveyards, old storage system (Silos) and an ancient well.
933160 PL1 PHP Injection Attack: High-Risk PHP Function Call Found
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL1 Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=5, HTTP=0, SESS=0, COMBINED_SCORE=5)

3 It will be joined by Faster Payments and the Cheque & Credit Clearing Company, which incorporates the Image Clearing System (ICS) that will replace the paper processing system for cheques, bringing these major retail payments under one consolidated roof.
933160 PL1 PHP Injection Attack: High-Risk PHP Function Call Found
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL1 Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=5, HTTP=0, SESS=0, COMBINED_SCORE=5)

4 Spruance-class destroyers were all built with the Mark 16 Mod 7 ASROC Launching Group and MK 4 ASROC Weapons Handling System (AWHS) reload system.
933160 PL1 PHP Injection Attack: High-Risk PHP Function Call Found
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL1 Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=5, HTTP=0, SESS=0, COMBINED_SCORE=5)


Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions