Sh4D0Byss

Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.

The OAuth 2.0 refresh-token grant uses an unmodified upstream League grant that issues new access tokens from a valid refresh token without verifying the current active status of the associated account. This allows a user who previously obtained a refresh token to continue generating valid access tokens even after their account has been deactivated or suspended (where `uIsActive` is set to 0), meaning account deactivation fails to revoke API access.

Stored cross-site scripting occurs because the YouTube block only applies the `trim()` function to stored width and height values. These values are then printed into iframe HTML attributes without escaping or integer casting. A user with `edit block` permission can inject an event handler that executes scripts for visitors viewing the page. If the visitor has administrative privileges, the script executes with those privileges.

PHP Object Injection occurs due to the use of `unserialize()` calls within the Workflow, Form block, and File/Set components that do not implement the `allowed classes` restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database.