Revive Adserver Reflected Cross-Site Scripting Vulnerability in ACL Management Scripts

A reflected cross-site scripting vulnerability has been identified in the 'banner-acl.php' and 'channel-acl.php' scripts of Revive Adserver. This issue allows an attacker to craft a URL containing an HTML payload in a specific parameter. When a logged-in administrator clicks the link, the HTML is rendered in the browser, executing any embedded malicious scripts. The vulnerability arises because the 'acls[0][executionorder]' parameter is output without proper sanitization, enabling the injection of harmful content that can be executed in HTML, JavaScript, or CSS contexts.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's browser session.