This vulnerability in Revive Adserver 6.0.6 and earlier arises from insufficient sanitisation of user input in the zone-include.php script, specifically the clientid parameter. A low-privileged user can exploit this to conduct blind SQL injection attacks, potentially impacting confidentiality, integrity, and availability of the system. The vendor has improved input validation to mitigate this risk, but no official patch or remediation level has been confirmed in the provided data.

Successful exploitation could allow an attacker with low privileges to perform blind SQL injection attacks, potentially leading to unauthorized data disclosure, data modification, or denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, with low confidentiality impact, high integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has improved input sanitisation for the affected parameter, but no official fix or patch has been explicitly stated. Users should monitor the vendor's advisories for updates and apply official patches once available. Until then, restricting access to the vulnerable script and applying web application firewalls with SQL injection detection may help mitigate risk.