AWAF Detection Inconsistency Between Similar Test Payloads

Hey Kuyidong​ 

Have you enabled specific attack-type signatures and enforced them within the security policy? For example, signatures related to command execution or Cross-Site Scripting (XSS).

Have a good read about Multipart/form-data below.

HTTP Multipart and Security Implications