Information Disclosure via Verbose Error Messages

How it was found

Version:

==revive-adserver 6.0.0==

Summary:

Revive Adserver v6.0.0 exposes sensitive technical details through verbose error messages, revealing the exact MySQL/MariaDB version, SQL queries, and PHP environment details. Attackers can use this information to identify known vulnerabilities or craft targeted attacks.

Step to reproduce:

1. Log in website
2. Go to http://<IP-address>>/admin/channel-acl.php?affiliateid=<<id>>&channelid=<<id>>
3. Add Client-Language --> Save changes
4. Intercept request, Enter ' (single quote) in the Execution order field.

{F4943854}

5. Submit and observe the detailed error output exposing MySQL/MariaDB version and SQL query.

{F4943876}

Impact

• Disclosure of backend details (DB version, structure, PHP info) may help attackers identify vulnerabilities or tailor attacks against the server.

Version: Revive Adserver v6.0.0
PHP/DB: PHP 8.4.13 / MySQL 10.6.22-MariaDB-0ubuntu0.22.04.1
INSERT INTO rv_acls_channel (channelid , logical , type , comparison , data , executionorder ) VALUES ...
INSERT INTO rv_acls_channel (...) VALUES (...)

http header raw:

POST /admin/channel-acl.php HTTP/1.1
Host: 192.168.109.200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 514
Origin: http://192.168.109.200
Sec-GPC: 1
Connection: keep-alive
Referer: http://192.168.109.200/admin/channel-acl.php
Cookie: sessionID=<<sessions>>
Upgrade-Insecure-Requests: 1
Priority: u=0, i

token=3f62fcfd14d8336b06e12b5adb678962&type=deliveryLimitations%3AClient%3ABrowserVersion&affiliateid=7&channelid=4&acl%5B0%5D%5Blogical%5D=and&acl%5B0%5D%5Btype%5D=deliveryLimitations%3AClient%3ABrowserVersion&acl%5B0%5D%5Bexecutionorder%5D=0&acl%5B0%5D%5Bcomparison%5D=nn&acl%5B0%5D%5Bdata%5D%5B%5D=Firefox&acl%5B1%5D%5Blogical%5D=and&acl%5B1%5D%5Btype%5D=deliveryLimitations%3AClient%3ALanguage&acl%5B1%5D%5Bexecutionorder%5D=1&acl%5B1%5D%5Bcomparison%5D=%3D%7E&acl%5B1%5D%5Bdata%5D%5B%5D=ar&submit=Save+Changes