alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Mambo Exploit"; flow:established,to_server; http.uri; content:"mosConfig_absolute_path="; fast_pattern; content:".php"; nocase; pcre:"/mosConfig_absolute_path=(https?|ftps?|php)\:\//i"; reference:url,seclists.org/lists/fulldisclosure/2005/Nov/0528.html; reference:url,isc.sans.org/diary.php?storyid=869; reference:url,www.us-cert.gov/cas/bulletins/SB07-106.html; classtype:web-application-attack; sid:2002681; rev:13; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_15;)