Update lucee-unset-credentials.yaml

http/vulnerabilities/other/lucee-unset-credentials.yaml

@@ -4,7 +4,8 @@ info:
   name: Lucee - Unset Credentials
   author: jpg0mez
   severity: high
-  description: The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.
+  description: |
+    The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.
   reference:
     - https://luceeserver.atlassian.net/browse/LDEV-926
     - https://www.petefreitag.com/blog/lucee-admin-password-box/
@@ -12,6 +13,9 @@ info:
     cwe-id: CWE-798
   metadata:
     max-request: 2
+    shodan-query: "html:\"Lucee\""
+    fofa-query: "app=\"Lucee-Engine\""
+    verified: true
   tags: lucee,default-login,unauth
 
 http:
@@ -19,11 +23,16 @@ http:
     path:
       - "{{BaseURL}}/lucee/admin/web.cfm"
       - "{{BaseURL}}/lucee/admin/server.cfm"
+      
     stop-at-first-match: true
     matchers:
       - type: word
-        words:
-          - "lucee"
-          - "New Password"
         part: body
+        words:
+          - "Lucee"
+          - "New Password"
         condition: and
+
+      - type: status
+        status:
+          - 200