Blind SQL injection via clientid parameter in zone‑include.php

Summary

HackerOne community member Kaushalendra Dubey (titanrain) has reported a missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks.

Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.