Blind SQL Injection Vulnerability in Revive Adserver by Revive Adserver

CVE-2026-107662

What is CVE-2026-107662?

A blind SQL injection vulnerability exists in Revive Adserver versions 6.0.8 and earlier, allowing authenticated managers with restricted access to extract sensitive data from the database. This vulnerability arises due to inconsistent handling of request input, permitting unauthorized values to bypass validation processes and affecting SQL queries in the banner-zone.php and campaign-zone.php administration pages. Attackers can leverage this flaw to retrieve sensitive information like password hashes and session identifiers. Exploiting an unexpired administrator session could provide attackers with elevated privileges, enabling them to alter critical configurations and disrupt ad delivery systems. The issue has been mitigated in version 6.0.9 through improvements in input registration processes.

References