On this page
Atomicorp WAF Rule 360151
Rule Summary
- Rule ID: 360151
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Injection Attack: Variable Function Call Found
- Observed CWEs: CWE-19 (1), CWE-20 (2), CWE-79 (3), CWE-89 (1), CWE-94 (6), CWE-95 (1), CWE-287 (1), CWE-798 (1), CWE-913 (2), CWE-918 (1), CWE-1188 (1), CWE-1336 (1)
- Revision: 43
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects Possible PHP injection attacks. It does this by looking for combinations of metacharacters and word/character segements encapsulated by parenthesese that may appear to be PHP variable function calls. If you have a false positive with this rule, please report it to us.
Troubleshooting
False Positives
If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.
Tuning Guidance
If you want to disable or tune this rule, please see the Tuning the Atomicorp WAF Rules page for basic information.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2026-47668 | DbGate - Remote Code Execution via Anonymous JWT | dbgate | 10.0 (v3.1) | Critical |
| CVE-2026-53753 | Crawl4AI <= 0.8.6 - Remote Code Execution | crawl4ai | 10.0 (v3.1) | Critical |
| CVE-2019-10758 | Mongo Express Remote Code Execution (CVE-2019-10758) | mongo-express | 9.9 (v3.1) | Critical |
| CVE-2026-34156 | NocoBase - VM Sandbox Escape to Remote Code Execution | nocobase | 9.9 (v3.1) | Critical |
| CVE-2012-5357 | Ektron 8.02 XSLT Transform Remote Code Execution | ektron content management system | 9.8 (v3.0) | Critical |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical |
| CVE-2024-39205 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | - | 9.8 (v3.1) | Critical |
| CVE-2026-61511 | vBulletin 6.x - Remote Code Execution | vBulletin | 9.3 (v4.0) | Critical |
| CVE-2025-1302 | JSONPath Plus < 10.3.0 - Remote Code Execution | jsonpath-plus | 8.9 (v4.0) | High |
| CVE-2023-7137 | Client Details System 1.0 - SQL Injection | client details system | 8.8 (v3.1) | High |
| CVE-2025-49619 | Skyvern SSTI Remote Code Execution | Skyvern | 8.5 (v3.1) | High |
| CVE-2026-0560 | LolLMS < 2.2.0 - Server-Side Request Forgery | lollms | 7.5 (v3.1) | High |
| CVE-2024-46507 | Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE | yeti | 7.3 (v3.1) | High |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High |
| CVE-2023-24488 | Citrix Gateway and Citrix ADC - Cross-Site Scripting | gateway | 6.1 (v3.1) | Medium |
| CVE-2024-24494 | Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) | daily habit tracker | 6.1 (v3.1) | Medium |
| CVE-2020-24963 | Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated) | best support system | 5.4 (v3.1) | Medium |
| CVE-2024-28397 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | pyload | 5.3 (v3.1) | Medium |
| CVE-2010-1870 | Apache Struts Remote Command Execution | struts | 5.0 (v2.0) | Medium |
| CVE-2015-0923 | Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution | ektron content management system | 5.0 (v2.0) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
Documentation Source
- Original wiki page: WAF 360151
- Source revision: 6397
- Source revision date: 2023-10-05