Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.

Affected: unknown Revive Adserver Vulnerabilities

======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: <= 6.0.8 Versions not affected: >= 6.0.9 Website: https://www.revive-adserver.com/ ========================================================================

======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------

Description -----------

Resolution ----------

References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html

========================================================…

Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.