1## autogenerated on 2025-03-26 09:41:25
2name: crowdsecurity/vpatch-CVE-2022-25488
3description: 'Atom CMS - SQLi (CVE-2022-25488)'
4rules:
5  - and:
6    - zones:
7        - URI
8      transform:
9        - lowercase
10      match:
11        type: contains
12        value: /admin/ajax/avatar.php
13    - zones:
14        - ARGS
15      variables:
16        - id
17      transform:
18        - lowercase
19      match:
20        type: regex
21        value: '[^0-9-]'
22
23labels:
24  type: exploit
25  service: http
26  confidence: 3
27  spoofable: 0
28  behavior: 'http:exploit'
29  label: "Atom CMS - SQL Injection"
30  classification:
31    - cve.CVE-2022-25488
32    - attack.T1190
33    - cwe.CWE-89
34