CVE-2013-7149

Related Files

Revive Adserver 3.0.1 SQL Injection

Posted Dec 20, 2013

Authored by Matteo Beccati

Revive Adserver versions 3.0.1 and below suffer from a remote SQL injection vulnerability. The XML-RPC delivery invocation script was failing to escape its input parameters in the same way the other delivery methods do, allowing attackers to inject arbitrary SQL code via the "what" parameter of the delivery XML-RPC methods. Also, the escaping technique used to handle such parameter in the delivery scripts was based on the addslashes PHP function and has now been upgraded to use the dedicated escaping functions for the database in use.

tags | advisory, remote, arbitrary, php, sql injection

advisories | CVE-2013-7149

SHA-256 | aae6d650022d7cd159dfd9c7aa3425dd04b9ca82313106207d0a48c48043025f

Download | Favorite | View