Threats tagged 'ghsa-2qh8-gvw9-5mhr'

A blind SQL injection vulnerability exists in Revive Adserver version 6.0.8 and earlier. This flaw allows an authenticated manager, restricted to one agency, to extract arbitrary database values via the banner-zone.php and campaign-zone.php administration pages. The vulnerability arises from inconsistent request-input precedence in permission checks and database queries, enabling an attacker to pass validation with an authorized identifier while injecting a different value into the SQL query. Extracted data can include sensitive information such as password hashes and active session identifiers. Reusing an unexpired administrator session can lead to full administrative access, enabling configuration changes and disruption of ad delivery. The issue is fixed in version 6.0.9 by correcting input handling and excluding cookies from input helpers.