This vulnerability in Revive Adserver (up to version 6.0.6) involves improper validation of user input when saving delivery limitations. A low-privileged user can add an unexpected component parameter that injects malicious PHP code into the compiledlimitations field. This code is executed during banner delivery, leading to potential full compromise of confidentiality, integrity, and availability. The vulnerability is classified as CWE-94 (Code Injection) and has a CVSS 3.0 score of 8.8, indicating high severity. No official patch or remediation level is currently documented, but input sanitization improvements have been noted.

Successful exploitation allows a low-privileged user to execute arbitrary PHP code on the server during banner delivery. This can lead to complete system compromise, including unauthorized access, data manipulation, and service disruption. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has improved input sanitization to filter unexpected parameters, which suggests that upgrading to a version later than 6.0.6 may mitigate the issue. Until an official fix is released, restrict low-privileged user capabilities and monitor for suspicious activity related to delivery limitations input.