I'm getting some Mod-Security 2 rule false positives from content updates in my cms. (300015 - generic sql injection)
Since all admin.php.* URLs are login-walled, is there any risk in whitelisting for that rule based on the the main admin page:
vs whitelisting more narrowly by targeting the admin query string:
I'm not sure it makes any security difference in going the query string route and create a SecRule with REQUEST_URI (or similar)?