This vulnerability in Revive Adserver involves insufficient sanitization of the clientid parameter in the zone-include.php script, enabling reflected XSS and potential blind SQL injection attacks by low-privileged users. Input validation improvements have been noted but no official patch or fix details are available. The CVSS 3.0 score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

An attacker with low privileges can exploit this vulnerability to execute reflected cross-site scripting attacks and potentially perform blind SQL injection via the clientid parameter. This could lead to partial disclosure of confidential information and modification of data integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Revive's advisories for updates. Until a fix is available, cautious handling of user input and restricting access to vulnerable scripts may reduce risk.