On this page
Atomicorp WAF Rule 340011
Rule Summary
- Rule ID: 340011
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Generic PHP exploit pattern denied
- Observed CWEs: CWE-22 (2), CWE-74 (1), CWE-78 (1), CWE-94 (16), CWE-95 (2), CWE-184 (1), CWE-269 (1), CWE-287 (2), CWE-306 (2), CWE-352 (1), CWE-862 (1), CWE-917 (1)
- Revision: 11
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request headers, Request cookies
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Generic PHP exploit pattern denied” in the request headers, request cookies. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2011-10013 | Traq admincp/common.php Remote Code Execution | Issue Tracking System | 10.0 (v4.0) | Critical |
| CVE-2025-32432 | Craft CMS Image Transform Preauth RCE (CVE-2025-32432) | craft cms | 10.0 (v3.1) | Critical |
| CVE-2019-15954 | Total.js CMS 12 Widget JavaScript Code Injection | total.js cms | 9.9 (v3.1) | Critical |
| CVE-2019-13372 | D-Link Central WiFi Manager CWM(100) RCE | central wifimanager | 9.8 (v3.1) | Critical |
| CVE-2022-22963 | Spring Cloud Function SpEL Code Injection (CVE-2022-22963) | spring cloud function | 9.8 (v3.1) | Critical |
| CVE-2022-35914 | GLPI htmLawed php command injection | glpi | 9.8 (v3.1) | Critical |
| CVE-2026-19626 | Tenable Security Center Report Charting RCE | security center | 9.4 (v4.0) | Critical |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | 9.3 (v4.0) | Critical |
| CVE-2015-10141 | xdebug Unauthenticated OS Command Execution | Xdebug | 9.3 (v4.0) | Critical |
| CVE-2026-41264 | Flowise CSV Agent Prompt Injection RCE | flowise | 9.2 (v4.0) | Critical |
| CVE-2008-4687 | Mantis manage_proj_page PHP Code Execution | mantis | 9.0 (v2.0) | High |
| CVE-2017-7411 | Tuleap 9.6 Second-Order PHP Object Injection | tuleap | 8.8 (v3.0) | High |
| CVE-2022-3405 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 8.8 (v3.1) | High |
| CVE-2011-4075 | phpLDAPadmin query_engine Remote PHP Code Injection | phpldapadmin | 7.5 (v2.0) | High |
| CVE-2011-4453 | PmWiki pagelist.php Remote PHP Code Injection Exploit | pmwiki | 7.5 (v2.0) | High |
| CVE-2012-5223 | vBSEO proc_deutf() Remote PHP Code Injection | vbseo | 7.5 (v2.0) | High |
| CVE-2012-6329 | TWiki MAKETEXT Remote Command Execution | perl | 7.5 (v2.0) | High |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High |
| CVE-2013-4557 | SPIP connect Parameter PHP Injection | spip | 7.5 (v2.0) | High |
| CVE-2014-1691 | Horde Framework Unserialize PHP Code Execution | horde application framework | 7.5 (v2.0) | High |
| CVE-2022-30995 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 7.5 (v3.1) | High |
| CVE-2008-6132 | phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection | phpscheduleit | 6.8 (v2.0) | Medium |
| CVE-2008-6825 | Trixbox langChoice PHP Local File Inclusion | trixbox | 6.8 (v2.0) | Medium |
| CVE-2014-8998 | X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution | x7 chat | 6.5 (v2.0) | Medium |
| CVE-2013-2121 | Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection | openstack | 6.0 (v2.0) | Medium |
| CVE-2014-8791 | Tuleap PHP Unserialize Code Execution | tuleap | 6.0 (v2.0) | Medium |
| CVE-2011-4642 | Splunk Search Remote Code Execution | splunk | 4.6 (v2.0) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.