EUVD-2026-38499
GHSA-372x-3mph-3rvp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Blind SQLi requires low-privileged auth (PR:L), no user interaction, enables full data exfiltration (C:H), limited write impact (I:L); scope unchanged.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
AnalysisAI
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate database contents via the unsanitized clientid parameter in zone-include.php. The vulnerability is compounded by a concurrent input validation failure that also enables cross-site scripting, reflected in the CWE-79 assignment and CVSS scope-change vector - suggesting the zone-include.php endpoint contains at least two distinct injection classes. No public exploit has been identified at time of analysis, and a fix is available in versions beyond 6.0.6 per the vendor advisory on HackerOne.
Technical ContextAI
Revive Adserver is a PHP-based open-source ad serving platform. The affected endpoint, zone-include.php, processes ad zone rendering requests and accepts a clientid parameter that is passed without sufficient sanitization into database queries, enabling blind (inferential) SQL injection. The CWE assigned is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), which is inconsistent with the description's explicit reference to blind SQLi; the tags confirm both XSS and SQLi are present, suggesting the same unsanitized input reaches both an HTML reflection context and a database query. The CPE string cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:* covers all versions up to and including 6.0.6. The discrepancy between the CVSS vector (PR:N/UI:R/S:C) - which models reflected XSS - and the description's characterization of SQLi by a low-privileged user is a notable data quality issue that security teams should verify against the vendor advisory.
RemediationAI
Upgrade Revive Adserver to the version released after 6.0.6 that incorporates the improved input sanitization described in the advisory; the exact fixed version is not specified in available data but should be confirmed via the vendor's HackerOne disclosure at https://hackerone.com/reports/3653316. If immediate upgrade is not possible, restrict access to zone-include.php via web server ACLs so that only trusted internal networks or authenticated sessions from known IP ranges can reach it - this reduces exposure to the SQLi vector but does not eliminate it for legitimate low-privileged users. Additionally, consider deploying a Web Application Firewall rule to detect and block SQL injection patterns (e.g., blind SQLi timing payloads, boolean-based conditionals) on the clientid parameter; this is a compensating control only and introduces the risk of false positives on legitimate ad zone requests. Review database account privileges for the Revive Adserver database user and enforce least-privilege so that even a successful SQLi attack cannot perform writes or access schemas outside the ad server's own tables.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today