From 1945435d7d89670ab038afc93c43f588390515f8 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Tue, 5 Mar 2024 17:40:44 +0530
Subject: [PATCH] Update lucee-unset-credentials.yaml

---
 .../other/lucee-unset-credentials.yaml          | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/http/vulnerabilities/other/lucee-unset-credentials.yaml b/http/vulnerabilities/other/lucee-unset-credentials.yaml
index 94d96ca638..9c49a49897 100644
--- a/http/vulnerabilities/other/lucee-unset-credentials.yaml
+++ b/http/vulnerabilities/other/lucee-unset-credentials.yaml
@@ -4,7 +4,8 @@ info:
   name: Lucee - Unset Credentials
   author: jpg0mez
   severity: high
-  description: The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.
+  description: |
+    The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.
   reference:
     - https://luceeserver.atlassian.net/browse/LDEV-926
     - https://www.petefreitag.com/blog/lucee-admin-password-box/
@@ -12,6 +13,9 @@ info:
     cwe-id: CWE-798
   metadata:
     max-request: 2
+    shodan-query: "html:\"Lucee\""
+    fofa-query: "app=\"Lucee-Engine\""
+    verified: true
   tags: lucee,default-login,unauth
 
 http:
@@ -19,11 +23,16 @@ http:
     path:
       - "{{BaseURL}}/lucee/admin/web.cfm"
       - "{{BaseURL}}/lucee/admin/server.cfm"
+      
     stop-at-first-match: true
     matchers:
       - type: word
-        words:
-          - "lucee"
-          - "New Password"
         part: body
+        words:
+          - "Lucee"
+          - "New Password"
         condition: and
+
+      - type: status
+        status:
+          - 200