Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2

How it was found

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. This vulnerability allows an attacker to inject malicious JavaScript code into the application, which is then executed in the context of the victim's browser. The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.

The vulnerability arises due to insufficient input sanitization of the compact parameter in the admin-search.php file. The compact parameter is directly embedded into the HTML output without proper escaping, allowing an attacker to inject arbitrary JavaScript code. The affected code is located in lib/templates/admin/layout/search.html:

<input type='hidden' name='compact' value='{$compact}'>

The compact parameter is passed to the template without proper sanitization in www/admin/admin-search.php:

phpAds_registerGlobalUnslashed('keyword', 'client', 'campaign', 'banner', 'zone', 'affiliate', 'compact');
...
if (!isset($compact)) {
    $compact = false;
}
...
$oTpl->assign('compact', $compact);

Proof of Concept (POC)

An attacker can exploit this vulnerability by crafting a malicious URL that includes a JavaScript payload in the compact parameter. When the administrator visits this URL, the malicious script is executed in their browser.

http://target-ip/www/admin/admin-search.php?affiliate=1&banner=1&campaign=1&client=1&compact=1'><script>alert(document.cookie)</script>&keyword=1&zone=1

Impact

The impact of this vulnerability is significant as it allows an attacker to: Steal sensitive information such as session cookies. Perform actions on behalf of the victim. Redirect the victim to malicious websites. Deface the application. This vulnerability can be exploited by any user who can trick a victim into clicking a malicious link, making it a critical security issue that requires immediate attention.