Web Exploitation Attempt: MODx manager LFI traversal in tvs.php class_key (CVE-2010-5278)

title: "Web Exploitation Attempt: MODx manager LFI traversal in tvs.php class_key (CVE-2010-5278)"
id: 3a0f94b1-fcdd-4c3d-8934-22367ea0a6a0
status: test
description: This rule flags web requests targeting MODx Revolution’s manager/controllers/default/resource/tvs.php with a class_key parameter containing directory traversal sequences and a null byte terminator, consistent with a local file inclusion attempt. Attackers may use this pattern to read arbitrary files from the server, such as sensitive system files. The detection relies on HTTP query string telemetry, specifically matching the exact tvs.php path and the encoded traversal payload in the class_key parameter.
references:
  - https://github.com/projectdiscovery/nuclei-templates
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2010/Exploits/CVE-2010-5278/web_cve_2010_5278_exploitation_attempt.yml
author: Subhash Popuri (@pbssubhash), Huntrule Team
date: 2021-08-25
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2010-5278
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: /manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00
  condition: selection
falsepositives:
  - Scanning from Nuclei
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: a4a899e8-fd7a-49dd-b5a8-7044def72d61
    type: derived