Revive Adserver CVE-2025-52664

Exploitation requires an authenticated session as a logged-in user of Revive Adserver 6.0.0 (CVSS PR:L), per both the vector and the description - it is NOT exploitable by unauthenticated anonymous visitors. No special non-default configuration is indicated by the available data; the vulnerable code path appears reachable by standard authenticated users. The primary limiting factor is therefore credential possession: deployments that restrict account creation and protect existing low-privilege accounts substantially reduce exposure, while instances allowing self-registration or hosting many untrusted advertiser/agency accounts are at materially higher risk. No user interaction by a victim is required (UI:N).

This is a genuine priority for any organization running Revive Adserver 6.0.0, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges - consistent with the description's 'logged in users' qualifier, meaning any authenticated account (including low-trust ad agency/advertiser accounts) suffices. The high impact triad (C:H/I:H/A:H) is credible for SQL injection (CWE-89), which can read, modify, or destroy database contents. Publicly available exploit code (HackerOne report #3395221) meaningfully raises real-world risk by lowering the skill barrier. However, no EPSS score was provided and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals and should not be conflated. The limiting factor is the PR:L authentication requirement: an attacker needs valid credentials, so exposure is largely confined to instances with untrusted or weakly-protected user accounts, or to post-credential-compromise scenarios. Net: a real, patch-now issue for exposed multi-user deployments, but the authentication gate makes it less wormable than an unauthenticated flaw of the same score.

An attacker with any valid low-privilege Revive Adserver account (e.g., an advertiser or agency login) submits a specifically crafted input containing SQL metacharacters to a vulnerable endpoint, which is concatenated unsafely into a backend database query. Because public exploit code exists (HackerOne #3395221), the attacker can readily extract sensitive data such as credentials or campaign data, tamper with records, or disrupt the service. The low attack complexity and network vector mean exploitation is reliable once credentials are held.