please notice ALL offending URI contain a double slash. Double slash URI pattern filtering prevents these attacks whatever your CMSms version.
Short to-be-tuned hardening example :
Code: Select all
RewriteCond %{REQUEST_URI} \/\/
RewriteRule ^.*$ - [F,L]
Pierre M.