Executive brief
Revive Adserver, a popular open-source ad serving platform, contains a security vulnerability in its zone management script. An attacker with low-level access could potentially manipulate database queries to extract sensitive information. This could lead to unauthorized data access or compromise the integrity of the advertising platform's operations.
Technical details
A blind SQL injection vulnerability exists in Revive Adserver versions 6.0.6 and earlier within the 'zone-include.php' script. The root cause is the lack of proper sanitization for the 'clientid' parameter. A low-privileged attacker can exploit this by injecting malicious SQL queries that return different responses based on the truth of the query, allowing for the exfiltration of database content. While the NVD entry mentions SQL injection, the associated CWE-79 and CVSS vector suggest potential cross-site scripting (XSS) implications as well. The vendor has addressed this in subsequent updates by improving input validation for all parameters processed by the script.
Affected products
- Revive Adserver 6.0.6 and earlier
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory