Loading...
Security Resources

Software Updates

Trustwave Web Application Firewall 4.53

Trustwave SpiderLabs® is pleased to announce the release of CorSigs version 4.53 for Trustwave Web Application Firewall (WAF) versions 8.5 and 9.0. These rules are written to detect attacks or classes of attacks on web applications and their components.

Release Summary

This release includes an out of date rules cleanup and the following new signatures inclusion:

  • Joomla! Component BT Media 1.0 SQLi
    The BT Media 1.0 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Guru Pro SQLi
    The Guru Pro component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component PayPlans 3.3.6 SQLi
    The PayPlans 3.3.6 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component com_publisher SQLi
    The publisher component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component CCNewsLetter 2.1.9 SQLi
    The CCNewsLetter 2.1.9 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Event Registration Pro Calendar 4.1.3 SQLi
    The Event Registration Pro Calendar 4.1.3 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component LMS King Professional 3.2.4.0 SQLi
    The LMS King Professional 3.2.4.0 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component PHP-Bridge 1.2.3 SQLi
    The PHP-Bridge 1.2.3 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component SIMGenealogy 2.1.5 SQLi
    The SIMGenealogy 2.1.5 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Ultimate Property Listing 1.0.2 SQLi
    The Ultimate Property Listing 1.0.2 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • GitHub Enterprise 2.8.7 RCE SSRF
    GitHub Enterprise below 2.8.7 allows an attacker attacker with network access via HTTP to compromise vulnerable component, resulting with possible server takeover.
  • Easy Web Search 4.0 SQLi
    Easy Web Search 4.0 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • FTP Made Easy PRO 1.2 SQLi
    FTP Made Easy PRO 1.2 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Quiz Deluxe 3.7.4 SQLi
    The Quiz Deluxe 3.7.4 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component OSDownloads 1.7.4 SQLi
    The OSDownloads 1.7.4 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Photo Contest 1.0.2 SQLi
    The Photo Contest 1.0.2 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Price Alert 3.0.2 SQLi
    The Price Alert 3.0.2 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Quiz Deluxe 3.7.4 SQLi
    The Quiz Deluxe 3.7.4 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Responsive Portfolio 1.6.1 SQLi
    The Responsive Portfolio 1.6.1 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Survey Force Deluxe 3.2.4 SQLi
    The Survey Force Deluxe 3.2.4 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Zap Calendar Lite 4.3.4 SQLi
    The Zap Calendar Lite 4.3.4 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Multi Level Marketing service_detail.php SQLi
    The Service Detail of Multi Level Marketing allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Multi Level Marketing SQLi news_detail
    The News Detail of Multi Level Marketing allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Multi Level Marketing event_detail.php SQLi
    The Event Detail of Multi Level Marketing allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • PHP Dashboards 4.4 SQLi
    PHP Dashboards 4.4 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-6089: phpCollab deletetopics.php 2.5.1 SQLi
    The deletetopics plugin of phpCollab 2.5.1 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-6089: phpCollab 2.5.1 SQLi
    The deletebookmarks plugin of phpCollab 2.5.1 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15965: Joomla! Component NS Download Shop 2.2.6 SQLi
    The NS Download Shop 2.2.6 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component Sponsor Wall 8.0 SQLi
    The Sponsor Wall 8.0 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15966: Joomla! Component Zh YandexMap 6.1.1.0 SQLi
    The Zh YandexMap 6.1.1.0 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15970: PHP CityPortal 2.0 SQLi
    PHP CityPortal 2.0 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15081: PHP Melody 2.6.1 SQLi
    PHP Melody 2.6.1 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15968: MyBuilder Clone 1.0 SQLi
    MyBuilder Clone 1.0 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15961: iProject Management System 1.0 SQLi
    iProject Management System 1.0 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-15958: D-Park Pro 1.0 SQLi
    D-Park Pro Domain Parking Script 1.0 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Oracle People Soft RCE
    Oracle People Soft allows an unauthenticated attacker to compromise vulnerable component that leads to remote code execution
  • CVE-2017-14960: EMC xPression 4.5SP1 Patch 13 xDashboard SQLi
    EMC xDashboard below v4.5SP1 Patch 13 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2017-17875: Joomla! Component JEXTN FAQ Pro 4.0.0 SQLi
    The JEXTN FAQ Pro 4.0.0 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • Joomla! Component User Bench 1.0 SQLi
    The User Bench 1.0 component for Joomla! allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2018-5211: PHP Melody 2.7.1 SQLi
    PHP Melody 2.7.1 allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • WordPress Plugin Admin Menu Tree Page View 2.6.9 XSS
    The Admin Menu Tree Page View 2.6.9 plugin for WordPress allows an attacker could perform a Persistent XSS attack if the victim has administrative rights.
  • WordPress Plugin CMS Tree Page View 1.4 XSS
    The CMS Tree Page View 1.4 plugin for WordPress allows an attacker could perform a Persistent XSS attack if the victim has administrative rights.
  • CVE-2018-5315: WordPress Plugin Events Calendar SQLi
    The Events Calendar 1.0 plugin for WordPress allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • CVE-2018-3811: WordPress Plugin Smart Google Code Inserter 3.5 SQLi
    The Smart Google Code Inserter 3.5 plugin for WordPress allows a remote user to execute arbitrary SQL commands via the vulnerable parameter.
  • WordPress Plugin Social Media Widget by Acurax 3.2.5 XSS
    The Social Media Widget by Acurax 3.2.5 plugin for WordPress allows an attacker could perform a Persistent XSS attack if the victim has administrative rights.
  • vBulletin routestring Unauthenticated RCE
    vBulletin version 5 allows a remote attacker to include unauthenticated file that leads to remote code execution

How to Update

No action is required by customers running versions 8.5 or 9.0 of Trustwave WAF who subscribe to the online update feature. Their deployments will update automatically.

Please note that even if blocking actions are defined for a protected site, Simulation Mode for these rules is ON by default to allow site managers to inspect the impact of new rules before blocking relevant traffic. If you want to activate blocking actions for this rule, you must update the Actions for this signature in the Policy Manager.