Overview for rules released by Trustwave SpiderLabs in January for ModSecurity Commercial Rules package. The rules are available for versions 2.9.x and 3.x of ModSecurity.
ModSecurity Commercial Rules detect attacks or classes of attacks on web applications and their components as well as provide virtual patches for public vulnerabilities.
Release Summary
WordPress Plugin Multiple Plugins from Wow-Company - Reflected XSS CVE-2023-2362
WordPress Plugin Icegram Engage < 3.1.12 - Reflected XSS CVE-2023-2398
WordPress Plugin Photo Gallery by Ays < 5.1.7 - Reflected XSS CVE-2023-2568
WordPress Plugin WP Custom Cursors < 3.2 - Admin+ SQLi CVE-2023-2221
WordPress Plugin Integration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLi CVE-2023-2527
WordPress Plugin Conditional Menus < 1.2.1 - Reflected XSS CVE-2023-2654
WordPress Plugin SupportCandy < 3.1.7 - Subscriber+ SQLi CVE-2023-2719
WordPress Plugin Super Socializer < 7.13.52 - Reflected XSS CVE-2023-2779
WordPress Plugin WP Brutal AI < 2.0.0 - SQL Injection via CSRF CVE-2023-2601
WordPress Plugin WP ERP < 1.12.4 - Admin+ SQL Injection CVE-2023-2744
WordPress Plugin WP Brutal AI < 2.0.1 - Admin+ Reflected XSS CVE-2023-2605
WordPress Plugin KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting CVE-2023-2624
WordPress Plugin Editorial Calendar < 3.8.3 - Contributor+ Stored XSS CVE-2022-4115
WordPress Plugin Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS CVE-2023-0588
WordPress Plugin Responsive CSS EDITOR <= 1.0 - Admin+ SQLi CVE-2023-2482
WordPress Plugin WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF CVE-2023-2842
WordPress Plugin Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution CVE-2023-2877
WordPress Plugin Post SMTP < 2.6.1 - Authenticated (Administrator+) SQL Injection
WordPress Plugin Post SMTP < 2.8.7 - Admin+ SQL Injection CVE-2023-6620
WordPress Plugin Post SMTP < 2.8.7 - Reflected Cross-Site Scripting CVE-2023-6621
WordPress Plugin POST SMTP Mailer < 2.8.8 - Authorization Bypass via type connect-app API CVE-2023-6875
How to Update
All the rules released this month are available for download and can be configured using the ModSecurity Dashboard. The rules are associated with the default profile and enabled for all licensed servers. To verify the rules were successfully downloaded by ModSecurity, log in to the ModSecurity Dashboard and verify the server "Last seen" date, which indicates the last successful download for the specified server.
