# CVE-2026-107662: Revive Adserver blind SQL injection in banner-zone.php

Source: https://junglewise.ai/threats/cve-2026-107662-blind-sql-injection-in-revive-adserver-6-0-8-and-earlier-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-107662 · Severity: high · CVSS 8.8 · Published 2026-11-11

Revive Adserver is an open-source ad management platform that serves and tracks advertisements. An authenticated manager can exploit a SQL injection vulnerability to extract sensitive data from the database, including password hashes and active administrator session tokens. An attacker with these stolen credentials could take over an administrator account, modify ad configurations, and disrupt ad delivery.

Technologies: [Revive Adserver](https://junglewise.ai/threats/technologies/revive-adserver-1). Vendors: [Revive](https://junglewise.ai/threats/vendors/revive).

## Quick answers

**Is CVE-2026-107662 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107662 being exploited in the wild.

**How severe is CVE-2026-107662?** High severity, with a CVSS score of 8.8, published 11 November 2026.

**Which products and versions are affected?** Revive Adserver 6.0.8 and earlier.

**Is there a fix for CVE-2026-107662?** Yes: fixed in Revive Adserver 6.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107662 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107662?** Check whether you run Revive Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Revive Adserver 6.0.9

## Technical details

The vulnerability stems from inconsistent handling of request input precedence between permission checks and database queries in banner-zone.php and campaign-zone.php. An attacker with restricted manager access can pass validation with an authorized numeric identifier while injecting a different, attacker-controlled value into the SQL query, enabling blind SQL injection to extract arbitrary database values. Fixes require two commits (e301dbbb7 and 0aa9d0124) that enforce consistent POST-before-GET precedence and exclude cookies from input helpers.

## Affected products

- Revive Adserver 6.0.8 and earlier

## Timeline

- 2026-11-11: disclosed

## References

- [https://hackerone.com/reports/3896779](https://hackerone.com/reports/3896779)

## Related threats

- [Revive Adserver authorization bypass in channel-edit.php](https://junglewise.ai/threats/cve-2026-82978-an-authorization-bypass-in-channel-edit-php-in-revive-adserver-6)
- [Revive Adserver CSRF in tracker modification](https://junglewise.ai/threats/cve-2026-77168-a-cross-site-request-forgery-vulnerability-in-tracker-invocation)
- [Revive Adserver authorization bypass in campaign-zone linking](https://junglewise.ai/threats/cve-2026-68486-an-authorization-bypass-in-campaign-zone-linking-in-revive)
- [Revive Adserver authorization bypass in website listing](https://junglewise.ai/threats/cve-2026-68485-an-authorization-bypass-in-website-index-php-in-revive-adserver-6)
- [Revive Adserver reflected cross-site scripting in popup options](https://junglewise.ai/threats/cve-2026-108565-a-reflected-cross-site-scripting-vulnerability-in-the-popup)