CVE-2026-7732 — Code-Projects BloodBank Managing System Unrestricted File Upload

title: CVE-2026-7732 - Code-Projects BloodBank Managing System Unrestricted File Upload
id: scw-2026-05-04-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-7732 by targeting the request_blood.php script with a POST request. This rule specifically looks for uploads of potentially malicious file types, indicating an unrestricted file upload attempt. This is the primary detection for the initial access vector of this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7732/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/request_blood.php'
      cs-method|exact:
          - 'POST'
      sc-status|exact:
          - '200'
      uri|contains:
          - '.php'
      uri|contains:
          - '.exe'
      uri|contains:
          - '.dll'
      uri|contains:
          - '.bat'
      uri|contains:
          - '.sh'
      uri|contains:
          - '.jsp'
      uri|contains:
          - '.asp'
      uri|contains:
          - '.cer'
      uri|contains:
          - '.crt'
      uri|contains:
          - '.key'
      uri|contains:
          - '.pfx'
      uri|contains:
          - '.pem'
      uri|contains:
          - '.config'
      uri|contains:
          - '.xml'
      uri|contains:
          - '.js'
      uri|contains:
          - '.html'
      uri|contains:
          - '.htm'
      uri|contains:
          - '.css'
      uri|contains:
          - '.jpg'
      uri|contains:
          - '.jpeg'
      uri|contains:
          - '.png'
      uri|contains:
          - '.gif'
      uri|contains:
          - '.txt'
      uri|contains:
          - '.docx'
      uri|contains:
          - '.pdf'
      uri|contains:
          - '.xls'
      uri|contains:
          - '.xlsx'
      uri|contains:
          - '.ppt'
      uri|contains:
          - '.pptx'
      uri|contains:
          - '.zip'
      uri|contains:
          - '.rar'
      uri|contains:
          - '.tar'
      uri|contains:
          - '.gz'
      uri|contains:
          - '.7z'
      uri|contains:
          - '.bak'
      uri|contains:
          - '.old'
      uri|contains:
          - '.tmp'
      uri|contains:
          - '.log'
      uri|contains:
          - '.csv'
      uri|contains:
          - '.json'
      uri|contains:
          - '.yaml'
      uri|contains:
          - '.yml'
      uri|contains:
          - '.md'
      uri|contains:
          - '.rtf'
      uri|contains:
          - '.odt'
      uri|contains:
          - '.ods'
      uri|contains:
          - '.odp'
      uri|contains:
          - '.psd'
      uri|contains:
          - '.ai'
      uri|contains:
          - '.eps'
      uri|contains:
          - '.svg'
      uri|contains:
          - '.webp'
      uri|contains:
          - '.ico'
      uri|contains:
          - '.ttf'
      uri|contains:
          - '.woff'
      uri|contains:
          - '.woff2'
      uri|contains:
          - '.eot'
      uri|contains:
          - '.otf'
      uri|contains:
          - '.ttf'
      uri|contains:
          - '.woff'
      uri|contains:
          - '.woff2'
      uri|contains:
          - '.eot'
      uri|contains:
          - '.otf'
      uri|contains:
          - '.mp3'
      uri|contains:
          - '.mp4'
      uri|contains:
          - '.avi'
      uri|contains:
          - '.mov'
      uri|contains:
          - '.wmv'
      uri|contains:
          - '.flv'
      uri|contains:
          - '.swf'
      uri|contains:
          - '.webm'
      uri|contains:
          - '.ogg'
      uri|contains:
          - '.wav'
      uri|contains:
          - '.midi'
      uri|contains:
          - '.aac'
      uri|contains:
          - '.flac'
      uri|contains:
          - '.opus'
      uri|contains:
          - '.ogg'
      uri|contains:
          - '.wav'
      uri|contains:
          - '.midi'
      uri|contains:
          - '.aac'
      uri|contains:
          - '.flac'
      uri|contains:
          - '.opus'
      condition: selection
  
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse