---
id: "CVE-2026-107662"
page: "https://infrastack.ai/live/CVE-2026-107662"
kind: "vulnerability"
aliases: ["CVE-2026-107662"]
title: "Revive Adserver: blind SQL injection exposes password hashes and admin sessions"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ad-servers", "package", "php", "revive-adserver", "self-hosted"]
not_affected_if: ["no-agency-restricted-managers", "version-6.0.9-or-later"]
published_at: "2026-11-11T18:18:24+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107662", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Revive Adserver: blind SQL injection exposes password hashes and admin sessions

Link for people: https://infrastack.ai/live/CVE-2026-107662 (this .md is for agents)

Revive Adserver 6.0.8 and earlier lets an authenticated agency-restricted manager inject SQL through the banner-zone and campaign-zone admin pages. An attacker can extract password hashes and active session identifiers, then reuse an unexpired administrator session to change configuration and disrupt ad delivery.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Revive Adserver version in its admin footer or `package.json`/installed release files; versions `6.0.8` and earlier are affected
- Confirm whether manager accounts restricted to a single agency exist in the admin panel

## Fix

- Revive Adserver: move to `6.0.9`, which includes commits e301dbbb7 and 0aa9d0124

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107662

## From the sources

Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_