Description

WordPress Plugin Google Adsense and Hotel Booking is prone to an open proxy vulnerability. Exploiting this issue may allow attackers to hide attacks on third parties, or DoS a site if the POST request is pointed back at itself causing a loop. WordPress Plugin Google Adsense and Hotel Booking version 1.0.5 is vulnerable; prior versions are also affected.

Remediation

Disable the plugin until a fix is available

References

http://www.vapidlabs.com/advisory.php?v=151

Related Vulnerabilities

MyBB Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-8104)

Ruby on Rails Use of Externally-Controlled Format String Vulnerability (CVE-2013-4389)

WordPress Plugin Gwolle Guestbook Remote File Inclusion (1.5.3)

PHP Improper Certificate Validation Vulnerability (CVE-2015-3152)

WordPress Plugin Mobile Device Detection by 51Degrees Cross-Site Scripting (3.1.5.2)

Severity

High

Classification

CVE-2015-1000009 CWE-441 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update