revive-adserver/revive-adserver — pull request #208 by florian-sander (2013-12-18 22:07:03+00:00)
Title: Fixed several SQL injection vulnerabilities.

There are several sql injection vulnerabilities in the delivery system of Revive. This change fixes them.

Please note that I did not re-generate the compiled delivery files since I do not have a build process set up. I would appreciate if a maintainer could do this.

Also please note that I could not test the changes in pgsql.php since I do not have a PostgreSQL server at hand. The fix is pretty straightforward, though, so I expect no issues.

These vulnerabilites are already being exploited. I discovered them after tracking down an attack on our OpenX installation. I have tested the vulnerability on Revive as well. The attacks on OpenX have been going on since at least September, so I would assume the vulnerability is well known in black hat circles by now.

For everyone who wants to patch their system right away, I have provided patched files for OpenX and Revive on my blog:

http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/

As [last time](https://github.com/revive-adserver/revive-adserver/pull/91), I do not want to explain publicly in detail how to exploit the vulnerability, but maintainers of the master repository can contact me privately if they need more information.