CVE-2026-34915
Description
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
Summary dbcve.org
A blind SQL injection vulnerability exists in zone-include.php of Revive Adserver 6.0.6 and earlier, where the clientid parameter lacks proper input sanitization, allowing low-privileged authenticated users to inject malicious SQL queries.
Mitigation
Upgrade to Revive Adserver version 6.0.7 or later where input sanitisation has been implemented; verify the patch is applied and conduct penetration testing to confirm the SQL injection is no longer exploitable.