Potential CVE-2023-25157 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•31

Detects a potential exploitation attempt of CVE-2023-25157, a SQL injection vulnerability in GeoServer. The rule looks for specific GET requests to '/geoserver/ows' containing 'CQL_FILTER=' along with known vulnerable functions or SQL injection keywords in the query string.