Listen to this Post
This vulnerability is a stored Cross-Site Scripting (XSS) flaw within the user management interface of Revive Adserver. It arises from improper neutralization of user-controlled input before it is output in the context of an advertiser user’s page. A manager-level account can inject malicious JavaScript payloads into specific input fields intended for their managed advertiser accounts. When an advertiser user later views their own profile or a relevant management page, the injected script is rendered and executed in their browser session. This allows the attacking manager to perform actions within the security context of the advertiser user, potentially leading to session hijacking, theft of credentials, or unauthorized changes to the advertiser’s campaigns, all without the advertiser’s direct knowledge.
Platform: Revive Adserver
Version: <=6.0.1
Vulnerability: Stored XSS
Severity: Medium
Date: 2025-11-20
Prediction: Patch 2025-12-15
What Undercode Say:
Check installed version grep 'version' /var/www/revive/constants.php Curl to test payload delivery (POST request to user update endpoint) curl -X POST 'http://target/agency/agency-user-edit.php' -d 'name=test&field=<script>alert(1)</script>' Simple grep for potential unescaped outputs grep -r "echo \$_POST|echo \$_GET" /path/to/revive/
How Exploit:
1. Attacker logs in as manager.
2. Edits an advertiser user’s details.
3. Injects script into vulnerable field.
4. Script saves to database.
5. Advertiser views page, script executes.
Protection from this CVE:
Update to patched version (>6.0.1).
Implement strict output encoding.
Apply Content Security Policy.
Impact:
Advertiser session compromise.
Limited data theft.
Unauthorized campaign modifications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
