False positive

[camikaze]

Hi,

First of all thanks for this great resource.

I m encountering some false alerts with trivial text .

Total impact: 7
Affected tags: xss, csrf, id, rfe, lfi

Variable: detail | Value: Recarga Apuestas-de-Deportes.com
Impact: 7 | Tags: xss, csrf, id, rfe, lfi
Description: Detects unknown attack vectors based on PHPIDS Centrifuge detection | Tags: xss, csrf, id, rfe, lfi | ID: 67

Centrifuge detection data
Threshold: 3.49
Ratio: 1.2307692307692

It always seems to be impact 7.



Also i get the same impacts someone else reported with :

Total impact: 7
Affected tags: xss, csrf, id, rfe, lfi

Variable: detail | Value: EL1, Hingna Road, MIDC, Electronic Zone, Nagpur-440000
Impact: 7 | Tags: xss, csrf, id, rfe, lfi
Description: Detects unknown attack vectors based on PHPIDS Centrifuge detection | Tags: xss, csrf, id, rfe, lfi | ID: 67

Centrifuge detection data
Threshold: 3.49
Ratio: 1.4411764705882

I m running CentOs 5.2 and recompiled PCRE already and unicode support is now working but I still get the same Impacts.

It seems the - in the request is causing it.

Total impact: 7
Affected tags: xss, csrf, id, rfe, lfi

Variable: detail | Value: Recarga - Apuestas de Deportes.com
Impact: 7 | Tags: xss, csrf, id, rfe, lfi
Description: Detects unknown attack vectors based on PHPIDS Centrifuge detection | Tags: xss, csrf, id, rfe, lfi | ID: 67

Centrifuge detection data
Threshold: 3.49
Ratio: 1.3076923076923

The value "Recarga de Apuestas de Deportes.com" does not trigger an impact.

[root@server ~]# pcretest -C
PCRE version 7.9 2009-04-11
Compiled with
UTF-8 support
Unicode properties support
Newline sequence is LF
\R matches all Unicode newlines
Internal link size = 2
POSIX malloc threshold = 10
Default match limit = 10000000
Default recursion depth limit = 10000000
Match recursion uses stack

Any ideas?

Thanks

[camikaze]

I think i was able to fix it using ShirKahns workaround.

Seems to work perfect now.

http://forum.phpids.org/comments.php?DiscussionID=190&page=2

[.mario]

Okay :)