{"id":"CVE-2026-107662","kind":"vulnerability","aliases":["CVE-2026-107662"],"related":[],"title":"Revive Adserver: blind SQL injection exposes password hashes and admin sessions","description":"Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.","summary":"Revive Adserver 6.0.8 and earlier lets an authenticated agency-restricted manager inject SQL through the banner-zone and campaign-zone admin pages. An attacker can extract password hashes and active session identifiers, then reuse an unexpired administrator session to change configuration and disrupt ad delivery.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ad-servers","package","php","revive-adserver","self-hosted"],"not_affected_if":["no-agency-restricted-managers","version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version in its admin footer or `package.json`/installed release files; versions `6.0.8` and earlier are affected\n- Confirm whether manager accounts restricted to a single agency exist in the admin panel","fix":"- Revive Adserver: move to `6.0.9`, which includes commits e301dbbb7 and 0aa9d0124","status":"open","published_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:16+00:00","updated_at":"2026-11-11T18:29:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:16Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: move to `6.0.9`, which includes commits e301dbbb7 and 0aa9d0124","reach":"internet","title":"Revive Adserver: blind SQL injection exposes password hashes and admin sessions","impact":"high","summary":"Revive Adserver 6.0.8 and earlier lets an authenticated agency-restricted manager inject SQL through the banner-zone and campaign-zone admin pages. An attacker can extract password hashes and active session identifiers, then reuse an unexpired administrator session to change configuration and disrupt ad delivery.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","php","ad-servers","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker extracts password hashes and takes over administrator sessions","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version in its admin footer or `package.json`/installed release files; versions `6.0.8` and earlier are affected\n- Confirm whether manager accounts restricted to a single agency exist in the admin panel","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.0.9-or-later","no-agency-restricted-managers"],"who_is_affected":"Sites running Revive Adserver 6.0.8 or earlier that have manager accounts restricted to one agency are exposed, since those accounts can reach the vulnerable banner-zone and campaign-zone pages. Installations on 6.0.9 or later, or without agency-restricted manager users, are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4757,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107662':14A,17A '-2026':13A,16A '0aa9d0124':201C '6.0.8':31B,83C '6.0.9':173C 'access':156C 'activ':61B,145C 'ad':19B,75B,164C 'ad-serv':18B 'admin':10A,52B 'administr':68B,104C,151C,155C 'adserv':2A,25B,30B,82C,172C 'agenc':38B,93C 'agency-restrict':37B 'allow':86C,119C,157C 'arbitrari':96C 'attack':55B,131C 'attacker-control':130C 'authent':36B,88C 'author':121C 'banner':46B 'banner-zon':45B 'banner-zone.php':101C 'blind':3A,77C 'campaign':50B 'campaign-zon':49B 'campaign-zone.php':103C 'chang':71B 'check':107C 'commit':198C 'common':188C 'complet':206C 'configur':72B,160C 'consist':175C 'control':132C 'cooki':193C 'correct':207C 'cve':12A,15A 'data':139C 'databas':97C,109C 'deliveri':76B,165C 'differ':129C 'disrupt':74B,162C 'e301dbbb7':199C 'earlier':33B,85C 'exclud':192C 'expos':6A 'extract':57B,95C,138C 'fix':169C 'get':180C 'global':184C 'grant':154C 'hash':8A,59B,143C 'helper':190C,196C 'host':28B 'identifi':63B,112C,123C,147C 'includ':141C 'inconsist':114C 'inject':5A,41B,79C 'input':117C,185C,189C 'issu':167C 'let':34B 'manag':40B,89C 'modif':158C 'numer':122C 'obtain':111C 'one':92C 'packag':21B 'page':53B,105C 'pass':125C 'password':7A,58B,142C 'permiss':106C 'php':22B 'post':177C 'preced':118C 'queri':110C,137C 'reach':134C 'registr':186C 'request':116C 'request-input':115C 'requir':203C 'restrict':39B,90C 'reus':65B,148C 'reviv':1A,24B,29B,81C,171C 'revive-adserv':23B 'select':176C 'self':27B 'self-host':26B 'server':20B 'session':11A,62B,69B,146C,152C 'sql':4A,42B,78C,136C 'unexpir':67B,150C 'valid':126C 'valu':98C,133C,178C,181C 'zone':47B,51B","nicknames":[],"mitigations":[],"who_affected":"Sites running Revive Adserver 6.0.8 or earlier that have manager accounts restricted to one agency are exposed, since those accounts can reach the vulnerable banner-zone and campaign-zone pages. Installations on 6.0.9 or later, or without agency-restricted manager users, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adservers","high","package","php","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-107662':14A,17A '-2026':13A,16A 'admin':10A 'adserv':2A 'blind':3A 'cve':12A,15A 'expos':6A 'hash':8A 'inject':5A 'password':7A 'reviv':1A 'session':11A 'sql':4A","search_b":"'6.0.8':31B 'activ':61B 'ad':19B,75B 'ad-serv':18B 'admin':52B 'administr':68B 'adserv':25B,30B 'agenc':38B 'agency-restrict':37B 'attack':55B 'authent':36B 'banner':46B 'banner-zon':45B 'campaign':50B 'campaign-zon':49B 'chang':71B 'configur':72B 'deliveri':76B 'disrupt':74B 'earlier':33B 'extract':57B 'hash':59B 'host':28B 'identifi':63B 'inject':41B 'let':34B 'manag':40B 'packag':21B 'page':53B 'password':58B 'php':22B 'restrict':39B 'reus':65B 'reviv':24B,29B 'revive-adserv':23B 'self':27B 'self-host':26B 'server':20B 'session':62B,69B 'sql':42B 'unexpir':67B 'zone':47B,51B","search_c":"'0aa9d0124':201C '6.0.8':83C '6.0.9':173C 'access':156C 'activ':145C 'ad':164C 'administr':104C,151C,155C 'adserv':82C,172C 'agenc':93C 'allow':86C,119C,157C 'arbitrari':96C 'attack':131C 'attacker-control':130C 'authent':88C 'author':121C 'banner-zone.php':101C 'blind':77C 'campaign-zone.php':103C 'check':107C 'commit':198C 'common':188C 'complet':206C 'configur':160C 'consist':175C 'control':132C 'cooki':193C 'correct':207C 'data':139C 'databas':97C,109C 'deliveri':165C 'differ':129C 'disrupt':162C 'e301dbbb7':199C 'earlier':85C 'exclud':192C 'extract':95C,138C 'fix':169C 'get':180C 'global':184C 'grant':154C 'hash':143C 'helper':190C,196C 'identifi':112C,123C,147C 'includ':141C 'inconsist':114C 'inject':79C 'input':117C,185C,189C 'issu':167C 'manag':89C 'modif':158C 'numer':122C 'obtain':111C 'one':92C 'page':105C 'pass':125C 'password':142C 'permiss':106C 'post':177C 'preced':118C 'queri':110C,137C 'reach':134C 'registr':186C 'request':116C 'request-input':115C 'requir':203C 'restrict':90C 'reus':148C 'reviv':81C,171C 'select':176C 'session':146C,152C 'sql':78C,136C 'unexpir':150C 'valid':126C 'valu':98C,133C,178C,181C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107662","severity":null,"published_at":"2026-11-11T18:18:24+00:00","modified_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}