fix: FPs with lastLogin keyword

plugins/phpmyadmin-rule-exclusions-before.conf

@@ -141,6 +141,7 @@ SecRule REQUEST_FILENAME "@endsWith /tbl_change.php" \
     ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query"
 
 # Editing / copying a row - saving row data
+# Keep in sync with rule 9513630.
 SecRule REQUEST_FILENAME "@endsWith /tbl_replace.php" \
     "id:9513220,\
     phase:1,\
@@ -177,6 +178,7 @@ SecRule REQUEST_FILENAME "@endsWith /tbl_replace.php" \
     ctl:ruleRemoveTargetById=942190;ARGS,\
     ctl:ruleRemoveTargetById=942230;ARGS,\
     ctl:ruleRemoveTargetById=942550;ARGS,\
+    ctl:ruleRemoveTargetById=932260;ARGS:fields_name[multi_edit][0][],\
     ctl:ruleRemoveTargetById=920270;ARGS:fields[multi_edit][0][],\
     ctl:ruleRemoveTargetById=930100;ARGS:fields[multi_edit][0][],\
     ctl:ruleRemoveTargetById=930110;ARGS:fields[multi_edit][0][],\
@@ -216,6 +218,7 @@ SecRule REQUEST_FILENAME "@endsWith /sql.php" \
     ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932115;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932235;ARGS:sql_query,\
+    ctl:ruleRemoveTargetById=932260;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932370;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932380;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=933120;ARGS:sql_query,\
@@ -622,6 +625,7 @@ SecRule ARGS:route "@streq /table/change" \
     ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query"
 
 # Editing / copying a row - saving row data
+# Keep in sync with rule 9513220.
 SecRule ARGS:route "@streq /table/replace" \
     "id:9513630,\
     phase:1,\
@@ -658,6 +662,7 @@ SecRule ARGS:route "@streq /table/replace" \
     ctl:ruleRemoveTargetById=942190;ARGS,\
     ctl:ruleRemoveTargetById=942230;ARGS,\
     ctl:ruleRemoveTargetById=942550;ARGS,\
+    ctl:ruleRemoveTargetById=932260;ARGS:fields_name[multi_edit][0][],\
     ctl:ruleRemoveTargetById=920270;ARGS:fields[multi_edit][0][],\
     ctl:ruleRemoveTargetById=930100;ARGS:fields[multi_edit][0][],\
     ctl:ruleRemoveTargetById=930110;ARGS:fields[multi_edit][0][],\
@@ -697,6 +702,7 @@ SecRule ARGS:route "@streq /sql" \
     ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932115;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932235;ARGS:sql_query,\
+    ctl:ruleRemoveTargetById=932260;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932370;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=932380;ARGS:sql_query,\
     ctl:ruleRemoveTargetById=933120;ARGS:sql_query,\

tests/regression/phpmyadmin-plugin/9513220.yaml

@@ -0,0 +1,25 @@
+# This test is disabled because it needs changes in the plugin configuration, which is currently not supported by FTW.
+# ---
+# meta:
+#   author: "azurit"
+#   description: "Test PhpMyAdmin Plugin"
+#   rule_id: 9513220
+# tests:
+#   - test_id: 1
+#     desc: Check FPs with the lastLogin keyword
+#     stages:
+#       - input:
+#          dest_addr: 127.0.0.1
+#            headers:
+#             Host: localhost
+#             User-Agent: "OWASP CRS test agent"
+#             Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+#             Cookie: phpMyAdmin=1
+#           port: 80
+#           method: POST
+#           version: HTTP/1.1
+#           uri: /post/tbl_replace.php
+#           data: fields_name[multi_edit][0][]=lastLogin
+#         output:
+#           log:
+#             no_expect_ids: [932260]

tests/regression/phpmyadmin-plugin/9513240.yaml

@@ -70,3 +70,22 @@
 #        output:
 #          log:
 #            no_expect_ids: [933150]
+#  - test_id: 4
+#    desc: Check FPs with the lastLogin keyword
+#    stages:
+#      - input:
+#          dest_addr: 127.0.0.1
+#          headers:
+#            Host: localhost
+#            User-Agent: "OWASP CRS test agent"
+#            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+#            Cookie: phpMyAdmin=1
+#            Content-Type: application/x-www-form-urlencoded
+#          port: 80
+#          method: POST
+#          version: HTTP/1.1
+#          uri: /post/sql.php
+#          data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29
+#        output:
+#          log:
+#            no_expect_ids: [932260]

tests/regression/phpmyadmin-plugin/9513630.yaml

@@ -0,0 +1,24 @@
+---
+meta:
+  author: "azurit"
+  description: "PhpMyAdmin Rule Exclusions Plugin"
+  rule_id: 9513630
+tests:
+  - test_id: 1
+    desc: Check FPs with the lastLogin keyword
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+            Cookie: phpMyAdmin=1
+          port: 80
+          method: POST
+          version: HTTP/1.1
+          uri: /post/index.php?route=/table/replace
+          data: fields_name[multi_edit][0][]=lastLogin
+        output:
+          log:
+            no_expect_ids: [932260]

tests/regression/phpmyadmin-plugin/9513650.yaml

@@ -69,3 +69,22 @@ tests:
         output:
           log:
             no_expect_ids: [933150]
+  - test_id: 4
+    desc: Check FPs with the lastLogin keyword
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+            Cookie: phpMyAdmin=1
+            Content-Type: application/x-www-form-urlencoded
+          port: 80
+          method: POST
+          version: HTTP/1.1
+          uri: /post/index.php?route=/sql
+          data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29
+        output:
+          log:
+            no_expect_ids: [932260]