The vulnerability originates from a missing sanitization of the user supplied clientid parameter within zone-include.php of Revive AdServer. A low‑privileged user can inject SQL code, leading to a blind SQL injection that may compromise data confidentiality and integrity. The CVSS score of 8.3 indicates a high severity of this flaw. No exploit has been reported publicly and the vulnerability is not listed in CISA’s KEV catalog.

The affected product is Revive Adserver, specifically versions 6.0.6 and earlier. Updates that include proper input validation for all zone‑include.php parameters have been released by Revive to mitigate this issue.

The exploit vector is likely a web‑based request to zone‑include.php where the attacker controls the clientid field. Because the flaw is a blind injection, an attacker would need to infer the impact through side‑channels such as timing or exceptions, but the high CVSS score reflects the potential for significant data exposure. Although the EPSS score is currently unavailable, the absence of public exploits and KEV listing suggests a moderate likelihood of widespread exploitation, yet the vulnerability remains a actionable risk for any site that has not upgraded beyond 6.0.6.