updated matcher

http/cves/2023/CVE-2023-1698.yaml

@@ -1,11 +1,11 @@
 id: CVE-2023-1698
 
 info:
-  name: WAGO - Unauthenticated Remote Command Execution
+  name: WAGO - Remote Command Execution
   author: xianke
   severity: high
   description: |
-    In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
+    In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise.
   reference:
     - https://onekey.com/blog/security-advisory-wago-unauthenticated-remote-command-execution/
     - https://nvd.nist.gov/vuln/detail/CVE-2023-1698
@@ -16,8 +16,8 @@ info:
     cwe-id: CWE-78
   metadata:
     max-request: 1
-    shodan-query: html:"WAGO"
-  tags: cve,cve2023,wago,rce,unauth
+    shodan-query: html:"/wbm/" html:"wago"
+  tags: cve,cve2023,wago,rce
 
 http:
   - raw:
@@ -34,8 +34,9 @@ http:
         part: body
         words:
           - '"license":'
-          - '"package":'
-          - 'uid'
+          - '"name":'
+          - 'uid='
+          - 'gid='
         condition: and
 
       - type: status