# 10. Remote Code Execution(PHP-CGI) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"10. Remote Code Execution(PHP-CGI) AUTO PREPEND FILE"; flow:established,to_server; content:"auto_prepend_file"; http_uri; fast_pattern:only; pcre:"/\bauto_prepend_file\s*?=/U"; sid:3000101; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"10. Remote Code Execution(PHP-CGI) ALLOW URL INCLUDE"; flow:established,to_server; content:"allow_url_include"; http_uri; fast_pattern:only; pcre:"/\ballow_url_include\s*?=/U"; sid:3000102; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"10. Remote Code Execution(PHP-CGI) PHP"; flow:established,to_server; content:"?"; http_uri; content:"-"; fast_pattern:only; http_uri; content:!"="; http_raw_uri; pcre:"/(?:\/(?:php)?|\.php)\?[\s\+]*\-[A-Za-z]/U"; sid:3000103; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"10. Remote Code Execution(PHP-CGI) Remote File Inclusion"; flow:established,to_server; content:".php?"; http_uri; content:"=php|3a|//"; http_uri; sid:3000104; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"10. Remote Code Execution(PHP-CGI) POST"; flow:established,to_server; content:"POST"; http_method; content:"php|3a 2f 2f|input"; http_raw_uri; content:"