Revive Adserver: Blind SQL injection in banner and campaign zone pages
Summary
Revive Adserver 6.0.8 and earlier contains a blind SQL injection in the banner-zone.php and campaign-zone.php administration pages. An authenticated manager restricted to one agency can extract arbitrary database values, including password hashes and active session identifiers. An attacker who reuses an unexpired administrator session can gain administrative access, change configuration and disrupt ad delivery.
Affected
- Revive Adserver 0 through 6.0.8
Fixed in
- Revive Adserver 6.0.9, including both commits e301dbbb7 and 0aa9d0124 (required for the complete correction)
- Release date of 6.0.9: Unknown.
Workaround
- Unknown. No workaround is documented; upgrading to 6.0.9 is the remediation.
Exploitation
- OffSeq reports: not known to be exploited.
- VulDB lists the status as 0-Day (publicly disclosed before a patch was available).
- No public proof of concept found in the research; this is not a complete check.
Our recommendation
- Upgrade to Revive Adserver 6.0.9 and verify that both commits e301dbbb7 and 0aa9d0124 are included.
- Restrict access to the admin interface by IP address or VPN until patched.
- Review manager accounts and remove unneeded access.
- After upgrading, end existing admin sessions and rotate administrator and manager passwords, since password hashes and session identifiers may have been exposed.
- Check whether the admin pages are reachable from the internet.
- CVE-2026-107247 is fixed in the same release, so one upgrade covers both.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HackerOne report hackerone.com
- CVE Record CVE-2026-107662 www.cve.org
- VulDB entry 435890 vuldb.com
- OffSeq radar CVE-2026-107662 radar.offseq.com
- CVE-2026-107247 (related fix, OffSeq) radar.offseq.com
- Full Disclosure, Jun 2026 (earlier Revive advisory) seclists.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:22.
Original description (NVD)
Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.