fix template

http/cves/2008/CVE-2008-1547.yaml

@@ -1,49 +1,34 @@
 id: CVE-2008-1547
+
 info:
-  name: Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 v6.5.7638 - Open Redirect
-  description: | 
-    .Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.
+  name: Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection
   author: ctflearner
   severity: medium
-  tags: 
-     - Microsoft Outlook Web Access (OWA)
-     - OWA
-     - Exchange Server 2003 SP2
-     - Open redirect
-     - web
-     - cve2008
+  description: |
+    Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.
   reference:
-    - https://www.exploit-db.com/exploits/32489
     - https://nvd.nist.gov/vuln/detail/CVE-2008-1547
-    - https://exchange.xforce.ibmcloud.com/vulnerabilities/46061 
-    - https://cxsecurity.com/issue/WLB-2008100048 
-    
+    - https://www.exploit-db.com/exploits/32489
+    - https://www.securityfocus.com/bid/31765/info
   classification:
-    cvss-metrics: CVSS:2.0/(AV:N/AC:M/Au:N/C:N/I:P/A:N)
+    cvss-metrics: AV:N/AC:M/Au:N/C:N/I:P/A:N
     cvss-score: 4.3
     cve-id: CVE-2008-1547
     cwe-id: CWE-601
     cpe: cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*
-  
   metadata:
-    max-request: 1
+    max-request: 2
+    shodan-query: http.title:"Outlook"
+  tags: cve,cve2008,redirect,owa,exchange,microsoft
 
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/exchweb/bin/redir.asp?URL=http://www.evil.com"
+      - "{{BaseURL}}/exchweb/bin/redir.asp?URL=https://interact.sh"
+      - "{{BaseURL}}/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttps%3A%2F%2Finteract.sh&reason=0"
 
-    stop-at-first-match: true
-    matchers-condition: and
     matchers:
       - type: regex
         part: header
         regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)evil\.com\/?(\/|[^.].*)?$'
-      - type: status
-        status:
-          - 301
-          - 302
-          - 307
-          - 308
-        condition: or
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'