CVE-2026-34915: Revive Adserver SQLi Vulnerability

CVE-2026-34915 Overview

CVE-2026-34915 is a blind SQL injection vulnerability in Revive Adserver version 6.0.6 and earlier. The flaw exists in the zone-include.php script, which fails to sanitise the clientid parameter before incorporating it into a database query. A low-privileged authenticated user can manipulate the parameter to inject arbitrary SQL fragments. Because the application does not return query results directly, exploitation relies on inference-based techniques such as boolean or time-based responses. The vendor has improved input sanitisation across all parameters processed by the script.

Critical Impact
Authenticated low-privilege users can execute blind SQL injection through the clientid parameter, potentially exposing advertising campaign data, account credentials, and other database contents.

Affected Products

Revive Adserver 6.0.6
Revive Adserver versions earlier than 6.0.6
Deployments exposing the zone-include.php script to authenticated users

Discovery Timeline

2026-06-23 - CVE-2026-34915 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-34915

Vulnerability Analysis

The vulnerability resides in the zone-include.php script of Revive Adserver, an open-source ad management platform. The script accepts a clientid parameter from authenticated users without applying input validation or parameterised query binding. The parameter flows directly into a SQL statement executed against the application database. Because the response does not surface query output to the user, the issue manifests as a blind SQL injection. An attacker infers data by crafting payloads that alter application behaviour or response timing based on the truth of injected conditions [CWE-89].

Root Cause

The root cause is missing sanitisation of user-controlled input. The clientid parameter is concatenated into a SQL query without type casting, allowlisting, or prepared statement placeholders. The vendor remediation focuses on validating all parameters processed by zone-include.php before they reach the database layer.

Attack Vector

Exploitation requires network access to the Revive Adserver instance and authentication as a low-privileged user. The attacker submits crafted values for the clientid parameter, typically using boolean conditions or time-delay functions such as SLEEP() to enumerate data. User interaction may be required depending on how the script is invoked. The scope is changed because the injected SQL can access database content beyond the user's intended privileges within the application.

No verified exploitation code is available. See the HackerOne Report #3653316 for additional technical context.

Detection Methods for CVE-2026-34915

Indicators of Compromise

HTTP requests to zone-include.php containing SQL keywords such as SELECT, UNION, SLEEP, or BENCHMARK within the clientid parameter
Anomalous query latency on the Revive Adserver database correlating with requests to the affected script
Repeated requests from a single authenticated session with incrementing or boolean-style payloads in clientid

Detection Strategies

Inspect web server access logs for zone-include.php requests where the clientid value is non-numeric or contains URL-encoded SQL metacharacters
Enable database query logging and alert on unusually long-running queries originating from the Revive Adserver application user
Deploy a web application firewall rule to flag SQL injection signatures targeting the clientid parameter

Monitoring Recommendations

Correlate authenticated user sessions with high request rates to administrative scripts in Revive Adserver
Monitor outbound network connections from the database host for unexpected data exfiltration
Review audit logs for low-privileged accounts performing actions inconsistent with their role

How to Mitigate CVE-2026-34915

Immediate Actions Required

Upgrade Revive Adserver to a version later than 6.0.6 that includes the improved input sanitisation
Restrict access to the Revive Adserver administrative interface using network controls and authentication policies
Audit existing user accounts and revoke unnecessary low-privileged access

Patch Information

Revive Adserver has released a version that improves input sanitisation in zone-include.php to validate all parameters before query execution. Administrators should review the HackerOne Report #3653316 for vendor remediation guidance and apply the fixed release.

Workarounds

Block external access to zone-include.php at the web server or reverse proxy layer if the script is not required
Apply WAF signatures that reject non-numeric values for the clientid parameter
Enforce least-privilege database accounts for the Revive Adserver application to limit the impact of successful injection

bash

# Example nginx rule to restrict clientid to numeric values
location ~ /zone-include\.php$ {
    if ($arg_clientid !~ "^[0-9]+$") {
        return 403;
    }
}