Reflected XSS Vulnerability in Revive Adserver by Revive
CVE-2016-9457
5.4MEDIUM
What is CVE-2016-9457?
The Revive Adserver software prior to version 3.2.3 is susceptible to reflected cross-site scripting (XSS) attacks. Attackers can exploit this vulnerability by sending malicious requests to the www/admin/stats.php endpoint. Parameters such as setPerPage, pageId, bannerid, period_start, and period_end are not adequately sanitized or escaped, allowing attackers to inject and execute arbitrary scripts in users' browsers. This could lead to unauthorized access to sensitive information or hijacked sessions. It is crucial for users of affected versions to update their software to mitigate this security risk.
Affected Version(s)
Revive Adserver All before 3.2.3 Revive Adserver All versions before 3.2.3