Add vpatch-CVE-2023-3197 rule and test by crowdsec-automation · Pull Request #1738 · crowdsecurity/hub

crowdsec-automation · 2026-03-30T12:47:01Z

Description

Adds a new AppSec rule crowdsecurity/vpatch-CVE-2023-3197 to detect unauthenticated SQL injection in the WordPress MStore API plugin, included in the crowdsecurity/appsec-wordpress collection.

Detection logic:

Matches requests where the URI contains /wp-json/api/flutter_multi_vendor/product-categories (case-insensitive, URL-decoded)
Flags requests where the id query parameter contains any character outside [a-z0-9] after applying lowercase and urldecode transforms (regex: [^a-z0-9])

This regex-based approach is robust since a legitimate numeric category id should only contain alphanumeric characters. Any injected SQL characters (spaces, parentheses, quotes, operators, etc.) will trigger the rule. The rule is included in the crowdsecurity/appsec-wordpress collection, which is the appropriate collection for WordPress-specific virtual patching rules.

A nuclei test template is included that verifies requests with a malicious id parameter (containing a SQL injection payload) are blocked with a 403 status.

Checklist

I have read the contributing guide
I have tested my changes locally
For new parsers or scenarios, tests have been added
I have run the hub linter and no issues were reported (see contributing guide)
Automated tests are passing
AI was used to generate any/all content of this PR

github-actions · 2026-03-30T12:47:27Z

Hello @crowdsec-automation and thank you for your contribution!

❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection:

🔴 crowdsecurity/vpatch-CVE-2023-3197 🔴

github-actions · 2026-03-30T12:47:28Z

Hello @crowdsec-automation and thank you for your contribution!

I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information.
I've found some errors in your scenarios, please fix them and re-submit your PR, or ask for help if you need it.

The following items have errors:

crowdsecurity/crs-exclusion-plugin-cpanel:

labels not found

crowdsecurity/crs-exclusion-plugin-dokuwiki:

labels not found

crowdsecurity/crs-exclusion-plugin-drupal:

labels not found

crowdsecurity/crs-exclusion-plugin-nextcloud:

labels not found

crowdsecurity/crs-exclusion-plugin-phpbb:

labels not found

crowdsecurity/crs-exclusion-plugin-phpmyadmin:

labels not found

crowdsecurity/crs-exclusion-plugin-wordpress:

labels not found

crowdsecurity/crs-exclusion-plugin-xenforo:

labels not found

Mitre ATT&CK

Information about mitre attack can be found here.
As an example, some common mitre attack techniques:

T1110 for bruteforce attacks
T1595 and T1190 for exploitation of public vulnerabilities
T1595 for generic scanning of exposed applications

Expected format is (where XXXX is the technique ID):

labels:
  classification:
    - attack.TXXXX

CVEs

If your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it.

Expected format is (where CVE-XXX-XXX is the CVE ID):

labels:
  classification:
    - cve.CVE-XXX-XXX

Behaviors

Please identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here.

Expected format is (where <behavior> is the behavior you want to target):

labels:
  behavior: <behavior>

See the labels documentation for more information.

buixor · 2026-03-30T12:52:00Z

@copilot please fix the search condition to look for non a-z0-9 patterns

Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/97af246c-3508-4526-bc57-e58fdcad9fbc Co-authored-by: buixor <990714+buixor@users.noreply.github.com>

Copilot · 2026-03-30T12:54:08Z

@copilot please fix the search condition to look for non a-z0-9 patterns

Updated in fa4c7a8 — changed the id parameter match from contains: ' and ' to regex: '[^a-z0-9]'. After lowercase + urldecode transforms, any id value containing characters outside [a-z0-9] (spaces, parentheses, quotes, etc.) will be flagged, which catches SQL injection attempts more broadly while still being precise to the endpoint.

github-actions · 2026-03-30T12:56:02Z

Hello @Copilot,

✅ The new VPATCH Rule is compliant, thank you for your contribution!

github-actions · 2026-03-30T12:56:07Z

Hello @Copilot and thank you for your contribution!

I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information.
I've found some errors in your scenarios, please fix them and re-submit your PR, or ask for help if you need it.

The following items have errors:

crowdsecurity/crs-exclusion-plugin-cpanel:

labels not found

crowdsecurity/crs-exclusion-plugin-dokuwiki:

labels not found

crowdsecurity/crs-exclusion-plugin-drupal:

labels not found

crowdsecurity/crs-exclusion-plugin-nextcloud:

labels not found

crowdsecurity/crs-exclusion-plugin-phpbb:

labels not found

crowdsecurity/crs-exclusion-plugin-phpmyadmin:

labels not found

crowdsecurity/crs-exclusion-plugin-wordpress:

labels not found

crowdsecurity/crs-exclusion-plugin-xenforo:

labels not found

Mitre ATT&CK

Information about mitre attack can be found here.
As an example, some common mitre attack techniques:

T1110 for bruteforce attacks
T1595 and T1190 for exploitation of public vulnerabilities
T1595 for generic scanning of exposed applications

Expected format is (where XXXX is the technique ID):

labels:
  classification:
    - attack.TXXXX

CVEs

If your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it.

Expected format is (where CVE-XXX-XXX is the CVE ID):

labels:
  classification:
    - cve.CVE-XXX-XXX

Behaviors

Please identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here.

Expected format is (where <behavior> is the behavior you want to target):

labels:
  behavior: <behavior>

See the labels documentation for more information.

buixor · 2026-04-01T13:04:39Z

@copilot move it to the wordpress vpatch collection

Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/a074b18e-c43e-471c-bc0d-cd618d811c83 Co-authored-by: buixor <990714+buixor@users.noreply.github.com>

Copilot · 2026-04-01T13:06:15Z

@copilot move it to the wordpress vpatch collection

Done in 38d0d50 — moved crowdsecurity/vpatch-CVE-2023-3197 from appsec-virtual-patching to appsec-wordpress collection.

github-actions · 2026-04-02T15:49:14Z

Hello @buixor and thank you for your contribution!

❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection:

🔴 crowdsecurity/vpatch-CVE-2023-6360 🔴
🔴 crowdsecurity/vpatch-CVE-2023-0600 🔴
🔴 crowdsecurity/vpatch-CVE-2023-0900 🔴
🔴 crowdsecurity/vpatch-CVE-2023-6567 🔴
🔴 crowdsecurity/vpatch-CVE-2023-23489 🔴
🔴 crowdsecurity/vpatch-CVE-2024-1061 🔴
🔴 crowdsecurity/vpatch-CVE-2023-3197 🔴
🔴 crowdsecurity/vpatch-CVE-2025-40552 🔴
🔴 crowdsecurity/vpatch-CVE-2023-6623 🔴
🔴 crowdsecurity/vpatch-CVE-2024-1071 🔴
🔴 crowdsecurity/vpatch-CVE-2023-4634 🔴
🔴 crowdsecurity/vpatch-CVE-2023-2009 🔴
🔴 crowdsecurity/vpatch-CVE-2023-23488 🔴

github-actions · 2026-04-02T15:49:25Z

Hello @buixor and thank you for your contribution!

I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information.
I've found some errors in your scenarios, please fix them and re-submit your PR, or ask for help if you need it.

The following items have errors:

crowdsecurity/crs-exclusion-plugin-cpanel:

labels not found

crowdsecurity/crs-exclusion-plugin-dokuwiki:

labels not found

crowdsecurity/crs-exclusion-plugin-drupal:

labels not found

crowdsecurity/crs-exclusion-plugin-nextcloud:

labels not found

crowdsecurity/crs-exclusion-plugin-phpbb:

labels not found

crowdsecurity/crs-exclusion-plugin-phpmyadmin:

labels not found

crowdsecurity/crs-exclusion-plugin-wordpress:

labels not found

crowdsecurity/crs-exclusion-plugin-xenforo:

labels not found

Mitre ATT&CK

Information about mitre attack can be found here.
As an example, some common mitre attack techniques:

T1110 for bruteforce attacks
T1595 and T1190 for exploitation of public vulnerabilities
T1595 for generic scanning of exposed applications

Expected format is (where XXXX is the technique ID):

labels:
  classification:
    - attack.TXXXX

CVEs

If your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it.

Expected format is (where CVE-XXX-XXX is the CVE ID):

labels:
  classification:
    - cve.CVE-XXX-XXX

Behaviors

Please identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here.

Expected format is (where <behavior> is the behavior you want to target):

labels:
  behavior: <behavior>

See the labels documentation for more information.

* Add vpatch-CVE-2023-3197 rule * Add vpatch-CVE-2023-3197 test config * Add CVE-2023-3197.yaml test * Add vpatch-CVE-2023-3197 rule to vpatch collection * Fix id parameter match to use regex for non a-z0-9 characters Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/97af246c-3508-4526-bc57-e58fdcad9fbc Co-authored-by: buixor <990714+buixor@users.noreply.github.com> * Move vpatch-CVE-2023-3197 to wordpress appsec collection Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/a074b18e-c43e-471c-bc0d-cd618d811c83 Co-authored-by: buixor <990714+buixor@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: buixor <990714+buixor@users.noreply.github.com> Co-authored-by: Thibault "bui" Koechlin <thibault@crowdsec.net>

crowdsec-automation added 4 commits March 30, 2026 14:46

Add vpatch-CVE-2023-3197 rule

47cf138

Add vpatch-CVE-2023-3197 test config

4b1d4c3

Add CVE-2023-3197.yaml test

207d2df

Add vpatch-CVE-2023-3197 rule to vpatch collection

93be808

crowdsec-automation assigned buixor Mar 30, 2026

Copilot started work on behalf of buixor March 30, 2026 12:52 View session

Fix id parameter match to use regex for non a-z0-9 characters

fa4c7a8

Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/97af246c-3508-4526-bc57-e58fdcad9fbc Co-authored-by: buixor <990714+buixor@users.noreply.github.com>

Copilot AI requested a review from buixor March 30, 2026 12:55

Copilot finished work on behalf of buixor March 30, 2026 12:55

Copilot started work on behalf of buixor April 1, 2026 13:04 View session

Move vpatch-CVE-2023-3197 to wordpress appsec collection

38d0d50

Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/a074b18e-c43e-471c-bc0d-cd618d811c83 Co-authored-by: buixor <990714+buixor@users.noreply.github.com>

Copilot finished work on behalf of buixor April 1, 2026 13:07

buixor approved these changes Apr 2, 2026

View reviewed changes

Merge branch 'master' into 1774874811-vpatch-CVE-2023-3197

91b57bc

buixor merged commit ccca125 into master Apr 15, 2026
14 checks passed

buixor deleted the 1774874811-vpatch-CVE-2023-3197 branch April 15, 2026 13:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add vpatch-CVE-2023-3197 rule and test#1738

Add vpatch-CVE-2023-3197 rule and test#1738
buixor merged 7 commits intomasterfrom
1774874811-vpatch-CVE-2023-3197

crowdsec-automation commented Mar 30, 2026 •

edited by Copilot AI

Loading

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

buixor commented Mar 30, 2026

Uh oh!

Copilot AI commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

buixor commented Apr 1, 2026

Uh oh!

Copilot AI commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

crowdsec-automation commented Mar 30, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Mitre ATT&CK

CVEs

Behaviors

Uh oh!

buixor commented Mar 30, 2026

Uh oh!

Copilot AI commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Mitre ATT&CK

CVEs

Behaviors

Uh oh!

buixor commented Apr 1, 2026

Uh oh!

Copilot AI commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Mitre ATT&CK

CVEs

Behaviors

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

crowdsec-automation commented Mar 30, 2026 •

edited by Copilot AI

Loading