Spam tickets via submitticket.php

[johnvicky]

Hi guys,

Getting some tickets directly through ticket system.

Anyway to block it. Example below:

Client: Bubba
Department: Support
Subject: uhWPANJqZWd
Priority: Medium



Logs below:

apache2/domlogs/ourdomain/my.ourdomain.co.za:188.143.234.155 - - [10/Oct/2016:21:40:07 +0200] "GET /submitticket.php?step=2&deptid=1&language=german HTTP/1.1" 200 6891 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
apache2/domlogs/ourdomain/my.ourdomain.co.za:188.143.234.155 - - [10/Oct/2016:21:40:09 +0200] "GET /includes/verifyimage.php HTTP/1.1" 200 1649 "http://my.ourdomain.co.za/submitticket.php?step=2&deptid=1&language=german" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
apache2/domlogs/ourdomain/my.ourdomain.co.za:188.143.234.155 - - [10/Oct/2016:21:40:11 +0200] "POST /submitticket.php?step=3 HTTP/1.1" 302 0 "http://my.ourdomain.co.za/submitticket.php?step=2&deptid=1&language=german" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
apache2/domlogs/ourdomain/my.ourdomain.co.za:188.143.234.155 - - [10/Oct/2016:21:40:14 +0200] "GET /submitticket.php?step=4 HTTP/1.1" 200 5909 "http://my.ourdomain.co.za/submitticket.php?step=2&deptid=1&language=german" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"

[baracuda]

I think you can do it via mod security rule sets.