Revive Adserver Reflected Cross-Site Scripting Vulnerability in afr.php Delivery Script

A reflected cross-site scripting vulnerability has been identified in the afr.php delivery script of Revive Adserver. This issue allows an attacker to create a URL containing an HTML payload in a parameter. When a logged-in administrator clicks the link, the HTML is rendered in the browser, executing any included malicious scripts. The vulnerability arises because the target GET parameter is output without proper sanitization, enabling the injection of harmful content into HTML, JavaScript, or CSS contexts.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's browser session.