DCN ip_block.php ip Parameter Command Injection Attempt

Tim Peck@timpeck

•updated Nov 10, 2025•0•20

This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.