Blind SQL injection due to request precedence issue in global input registration

Summary

Description

HackerOne community member sh4d0byss has reported blind SQL injection in the banner-zone and campaign-zone administration pages. Permission checks and database queries could use different values for the same request parameter. A restricted manager could exploit this mismatch to extract arbitrary database values, including password hashes and active session identifiers. Reusing an extracted, unexpired administrator session can grant administrative access and the ability to modify configuration or disrupt ad delivery.

Resolution

The fix combines the request-precedence correction described in the authorization bypass finding with changes to the common input helpers. Global input registration and query-side helpers now both read POST values before GET values, ensuring that permission checks and database queries use the same identifiers. Cookies are excluded from this input path, removing dependence on the PHP request_order configuration. Both changes are required to close the reported input-source mismatch.

Security advisory

https://www.revive-adserver.com/security/revive-sa-2026-004