CVE-2026-107662: SQL Injection
Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated manager account restricted to a single agency can exploit it. The flaw is exposed through the banner-zone.php and campaign-zone.php administration pages.
What access does an attacker need before exploitation?
The attacker needs valid authentication as a manager and an authorized numeric identifier that passes the permission check. They then supply a different attacker-controlled value through inconsistent request-input handling so it reaches an SQL query.
What could an attacker obtain or do?
The attacker can extract arbitrary database values, including password hashes and active session identifiers. An unexpired administrator session identifier may be reused to obtain administrative access, modify configuration, and disrupt ad delivery.
Which versions are affected and what fixes the issue?
Revive Adserver 6.0.8 and earlier are affected. Version 6.0.9 fixes the issue, but the complete correction requires both commits e301dbbb7 and 0aa9d0124.