Revive Adserver EUVD-2026-38499

Exploitation of the SQL injection vector requires a valid low-privileged account on the Revive Adserver instance - anonymous unauthenticated attackers cannot exploit the SQLi as described ('low-privileged user' per the description). The vulnerable endpoint zone-include.php must be network-accessible, which is a standard deployment requirement for ad serving functionality. Exploitation of the XSS component (per CVSS PR:N/UI:R) requires no authentication but does require a victim user to follow a crafted link, limiting autonomous exploitation. Blind SQLi does not require user interaction beyond the attacker's own authenticated session. Limiting factors: internal-only deployments with restricted zone-include.php access are not exploitable remotely; deployments without multi-user or self-serve advertiser portals have a reduced attack surface because low-privileged accounts may not exist; upgrading beyond version 6.0.6 eliminates the vulnerability entirely.

The NVD-assigned CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects the XSS component of this vulnerability - scope change and user interaction are hallmarks of reflected XSS scoring. However, the description explicitly identifies blind SQL injection as the primary attack, which would carry a substantially higher real-world risk: blind SQLi typically enables full database exfiltration with no user interaction and requires only authenticated low-privilege access, warranting PR:L/UI:N and a higher CVSS base score in the 7+ range. EPSS data was not provided, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No POC has been identified. Real-world risk is moderate-to-high for organizations running Revive Adserver with externally accessible ad serving endpoints and multi-user environments, because low-privileged accounts (e.g., advertiser or publisher logins) can trigger the injection without administrative access. The CVSS score likely underrepresents the SQLi impact - security teams should treat this as a higher-priority remediation than the 6.1 score implies.

A low-privileged user - such as an advertiser or zone manager account - crafts a malicious HTTP request to zone-include.php with a boolean-based or time-based blind SQLi payload in the clientid parameter. By iterating requests and observing response timing or conditional differences, the attacker enumerates the database schema and extracts sensitive data such as advertiser credentials, campaign configuration, or platform user table contents without triggering direct error messages. No public exploit code has been identified at time of analysis, but the technique is well-documented and standard tooling such as sqlmap can automate this class of attack.