Merge pull request #2526 from projectdiscovery/unauthenticated-mongo-express

Update unauthenticated-mongo-express.yaml

misconfiguration/unauthenticated-mongo-express.yaml

@@ -1,8 +1,8 @@
-id: unauthenticated-mongo-express.yaml
+id: unauthenticated-mongo-express
 
 info:
   name: Mongo Express Unauthenticated
-  author: dhiyaneshDK
+  author: dhiyaneshDK,b0rn2r00t
   severity: high
   reference: https://www.exploit-db.com/ghdb/5684
   tags: mongo,unauth
@@ -12,12 +12,15 @@ requests:
     path:
       - '{{BaseURL}}'
       - '{{BaseURL}}/mongo-express/'
+      - '{{BaseURL}}/db/admin/system.users'
 
     matchers-condition: and
     matchers:
       - type: word
         words:
           - '<title>Home - Mongo Express</title>'
+          - '<title>system.users - Mongo Express</title>'
+        condition: or
       - type: status
         status:
           - 200