Revive Adserver Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Revive Adserver versions 6.0.1, 5.5.2, and earlier. The issue arises from a missing JSON content-type header in the 'inventory-retrieve.php' script, which allows a logged-in manager user to inject and execute scripts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log in as a manager user and navigate to the 'Inventory' section, then to 'Campaign'. Add a payload containing a script, such as an image tag with an 'onerror' event, into the 'Name' field. After saving the campaign, open the 'inventory-retrieve.php' script with the appropriate client ID. The injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update to the latest version of Revive Adserver, where this vulnerability has been addressed.