added flow and matchers

http/cves/2024/CVE-2024-4836.yaml

@@ -11,12 +11,25 @@ info:
     - https://github.com/sleep46/CVE-2024-4836_Check
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4836
   metadata:
-    verified: "true"
-    max-request: 1
-    fofa-query: "Edito CMS"
+    max-request: 5
+    fofa-query: icon_hash="1491301339"
   tags: cve,cve2024,cms,edito,info-leak
 
+flow: http(1) && http(2)
+
 http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_any(body,"content=\"edito", "www.edito.pl")'
+          - 'status_code==200'
+        condition: and
+        internal: true
+
   - method: GET
     path:
       - "{{BaseURL}}/config.php"
@@ -27,6 +40,6 @@ http:
     matchers:
       - type: dsl
         dsl:
-          - 'contains(body,"db_password")'
+          - 'contains_all(body,"db_password", "db_username")'
           - 'status_code==200'
         condition: and