A cross-site request forgery (CSRF) vulnerability exists in tracker-invocation.php in Revive Adserver version 6.0.8 and earlier. This flaw allows an attacker to modify a tracker's name, description, or advertiser assignment by leveraging an authenticated victim's permissions. The vulnerability arises from a leftover state-changing handler that processes request parameters without verifying a CSRF token. Exploitation requires victim interaction and the victim's session credentials to be included in the request. The issue is addressed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler.