Fix: False Positives in CVE-2002-1131 (SquirrelMail Fingerprint)

http/cves/2002/CVE-2002-1131.yaml

@@ -2,7 +2,7 @@ id: CVE-2002-1131
 
 info:
   name: SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting
-  author: dhiyaneshDk
+  author: dhiyaneshDk,s4e-io
   severity: high
   description: The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
   impact: |
@@ -14,7 +14,6 @@ info:
     - http://www.debian.org/security/2002/dsa-191
     - http://sourceforge.net/project/shownotes.php?group_id=311&release_id=110774
     - https://www.exploit-db.com/exploits/21811
-    - https://nvd.nist.gov/vuln/detail/CVE-2002-1131
   classification:
     cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
     cvss-score: 7.5
@@ -45,19 +44,11 @@ http:
 
     stop-at-first-match: true
 
-    matchers-condition: and
     matchers:
-      - type: word
-        part: body
-        words:
-          - "</script><script>alert(document.domain)</script>"
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
-# digest: 4a0a00473045022100a4f11d5119788802b4125d6a7156fccbb5ca9facec13453113752fa411f895120220655a2f24007185d3bdb9e146b5421f7921c94479c48504a7a3a46a2213870634:922c64590222798bb761d5b6d8e72950
+      - type: dsl
+        dsl:
+          - 'contains(body, "</script><script>alert(document.domain)</script>")'
+          - 'contains(tolower(body), "squirrelmail")'
+          - 'contains(content_type, "text/html")'
+          - 'status_code == 200'
+        condition: and