Revive Adserver Cross-Site Scripting Vulnerability in Banner Advanced Configuration Page

A cross-site scripting (XSS) vulnerability has been identified in Revive Adserver version 5.4.1. The issue resides in the banner advanced configuration page, where attackers can inject malicious scripts. By crafting a link to the banner-advanced.php endpoint and including XSS payloads in the prepend and append parameters, attackers can execute arbitrary JavaScript when an admin views the page.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the banner creation section and select the advanced settings. Inject a script payload into the prepend and append parameters. When the admin saves the banner and views the advanced configuration page, the injected script will execute.

Remediation

Users are advised to update to Revive Adserver version 6.0.4, which addresses this vulnerability.