1name: crowdsecurity/vpatch-CVE-2018-20062
2description: "ThinkPHP - RCE (CVE-2018-20062)"
3rules:
4  - and:
5    - zones:
6      - URI
7      transform:
8      - lowercase
9      match:
10        type: endsWith
11        value: index.php
12    - zones:
13      - ARGS
14      variables:
15      - s
16      transform:
17      - lowercase
18      match:
19        type: contains
20        value: think
21    - zones:
22      - ARGS
23      variables:
24      - s
25      transform:
26      - lowercase
27      match:
28        type: regex
29        value: "[^A-Za-z0-9_.]*"
30labels:
31  type: exploit
32  service: http
33  confidence: 3
34  spoofable: 0
35  behavior: "http:exploit"
36  label: "ThinkPHP - RCE"
37  references:
38    - https://nvd.nist.gov/vuln/detail/CVE-2018-20062
39    - https://www.exploit-db.com/exploits/45978
40  classification:
41   - cve.CVE-2018-20062
42   - attack.T1595
43   - attack.T1190
44