1## autogenerated on 2025-04-23 12:56:40
2name: crowdsecurity/vpatch-CVE-2002-1131
3description: 'Detects XSS attempts in SquirrelMail 1.2.6/1.2.7 via unsanitized input in addressbook, options, search, and help modules.'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - urldecode
10          - lowercase
11        match:
12          type: contains
13          value: /src/addressbook.php
14      - zones:
15          - ARGS_NAMES
16        transform:
17          - urldecode
18          - lowercase
19        match:
20          type: contains
21          value: <
22  - and:
23      - zones:
24          - URI
25        transform:
26          - urldecode
27          - lowercase
28        match:
29          type: contains
30          value: /src/options.php
31      - zones:
32          - ARGS
33        variables:
34          - optpage
35        transform:
36          - urldecode
37          - lowercase
38        match:
39          type: contains
40          value: <
41  - and:
42      - zones:
43          - URI
44        transform:
45          - urldecode
46          - lowercase
47        match:
48          type: contains
49          value: /src/search.php
50      - zones:
51          - ARGS
52        variables:
53          - mailbox
54          - where
55        transform:
56          - urldecode
57          - lowercase
58        match:
59          type: contains
60          value: <
61  - and:
62      - zones:
63          - URI
64        transform:
65          - urldecode
66          - lowercase
67        match:
68          type: contains
69          value: /src/help.php
70      - zones:
71          - ARGS
72        variables:
73          - chapter
74        transform:
75          - urldecode
76          - lowercase
77        match:
78          type: contains
79          value: <
80
81labels:
82  type: exploit
83  service: http
84  confidence: 3
85  spoofable: 0
86  behavior: 'http:exploit'
87  label: 'SquirrelMail - XSS'
88  classification:
89    - cve.CVE-2002-1131
90    - attack.T1059
91    - cwe.CWE-80
92