CVE-2014-125093: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to version 1.2.2 is able to address this issue. The patch is identified as 3312b9cd79e5710d1e282fc9216a4e5ab31b3d94. It is recommended to upgrade the affected component. VDB-222610 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-03-10T02:15Z
Repository: https://github.com/wp-plugins/ad-blocking-detector
Language: PHP
Files changed: ad-blocking-detector.php, readme.txt
Commit date: 2014-04-22 00:59:58 +0000
Commit message: Fix full path disclosure vulnerability and increment version.

git-svn-id: https://plugins.svn.wordpress.org/ad-blocking-detector/trunk@899810 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/ad-blocking-detector.php b/ad-blocking-detector.php
index f51b425..844dfec 100644
--- a/ad-blocking-detector.php
+++ b/ad-blocking-detector.php
@@ -1,11 +1,11 @@
 <?php
 /**
  * Plugin Name: Ad Blocking Detector
  * Plugin URI: http://adblockingdetector.jtmorris.net
  * Description: A plugin to detect ad blocking browser extensions and display alternative content to site visitors.
- * Version: 1.2.1
+ * Version: 1.2.2
  * Author: John Morris
  * Author URI: http://jtmorris.net
  * License: GPL2
  */
 
@@ -36,9 +36,28 @@ include_once ( ABD_ROOT_PATH . 'includes/hooks.php' );
 include_once ( ABD_ROOT_PATH . 'includes/enqueue.php' );
 include_once ( ABD_ROOT_PATH . 'includes/ajax-actions.php' );
 include_once ( ABD_ROOT_PATH . 'includes/shortcodes.php' );
 
 
-//	Start SESSION to facilitate data transfers
-if ( !session_id() ) {
-	session_start();
-}
\ No newline at end of file
+//      Start SESSION to facilitate data transfers
+//      Error Prevention: http://www.php.net/manual/en/function.session-start.php#82957
+function my_session_start()
+{
+        if (isset($_COOKIE['PHPSESSID'])) {
+                $sessid = $_COOKIE['PHPSESSID'];
+        }
+        else if (isset($_GET['PHPSESSID'])) {
+                $sessid = $_GET['PHPSESSID'];
+        }
+        else {
+                session_start();
+                return false;
+        }
+
+        if (!preg_match('/^[a-z0-9]{32}$/', $sessid)) {
+                return false;
+        }
+        session_start();
+
+        return true;
+}
+my_session_start();
diff --git a/readme.txt b/readme.txt
index cda02f6..3045495 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: jtmorris
 Donate link: http://adblockingdetector.jtmorris.net/
 Tags: adblock, adblocker, ad blocker, adblock plus, detector, advertisement
 Requires at least: 3.8
 Tested up to: 3.9
-Stable tag: 1.2.1
+Stable tag: 1.2.2
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Don't let ad blocker wielding visitors see a blank space. This plugin will display alternative content if ad blocking is detected.
 
@@ -72,10 +72,12 @@ to display rotating ads while harnessing the power of ad block detection.  You c
 1. Example of the administration backend.
 2. Example of behavior in a WordPress post with one of the sample shortcodes.
 
 
 == Changelog ==
+= 1.2.2 =
+* Fixed PHP warnings when PHPSESSID cookie contains illegal characters.
 = 1.2.1 =
 * Add support for WordPress 3.9.
 = 1.2.0 =
 * Enabled shortcode processing in ad code. Now you can take advantage of other [plugin's capabilities](http://adblockingdetector.jtmorris.net/display-rotating-ads/) inside Ad Blocking Detector code.
 * Bug fixes.
@@ -98,10 +100,12 @@ to display rotating ads while harnessing the power of ad block detection.  You c
 = 0.1 =
 * Initial version. No changes to report.
 
 
 == Upgrade Notice ==
+= 1.2.2 =
+SECURITY UPDATE: This update plugs a security hole that, in cicumstances, gave [Full Path Disclosure](https://www.owasp.org/index.php/Full_Path_Disclosure).
 = 1.2.0 =
 Added a powerful new feature: shortcode support. Now you can [integrate content from other plugins](http://adblockingdetector.jtmorris.net/display-rotating-ads/) with Ad Blocking Detector.
 = 1.1.3 =
 Bug fixes allowing for easier error debugging.
 = 1.1.0 =

Vulnerable code:  * Version: 1.2.1
//	Start SESSION to facilitate data transfers
if ( !session_id() ) {
	session_start();
}
Stable tag: 1.2.1
Fixed code:  * Version: 1.2.2
//      Start SESSION to facilitate data transfers
//      Error Prevention: http://www.php.net/manual/en/function.session-start.php#82957
function my_session_start()
{
        if (isset($_COOKIE['PHPSESSID'])) {
                $sessid = $_COOKIE['PHPSESSID'];
        }
        else if (isset($_GET['PHPSESSID'])) {
                $sessid = $_GET['PHPSESSID'];
        }
        else {
                session_start();
                return false;
        }

        if (!preg_match('/^[a-z0-9]{32}$/', $sessid)) {
                return false;
        }
        session_start();

        return true;
}
my_session_start();
Stable tag: 1.2.2
= 1.2.2 =
* Fixed PHP warnings when PHPSESSID cookie contains illegal characters.
= 1.2.2 =
SECURITY UPDATE: This update plugs a security hole that, in cicumstances, gave [Full Path Disclosure](https://www.owasp.org/index.php/Full_Path_Disclosure).