A stored XSS vulnerability in Revive Adserver versions 6.0.1 and earlier, and 5.5.2 and earlier, poses a high risk of session hijacking and unauthorized information disclosure.

This vulnerability involves improper input neutralization within the stats-conversions.php script. It requires a logged-in user with low privileges and user interaction to trigger the stored XSS payload, which can lead to session hijacking and sensitive information exposure.

The vulnerability carries a CVSS score of 8.7, reflecting a high potential for impact on organizational security. A successful exploit allows an attacker to hijack user sessions, potentially gaining administrative access to the ad management platform, which could lead to unauthorized ad redirection, data theft, or further compromise of the web server environment.

Immediate Action: Update Revive Adserver to version 6.0.2 or 5.5.3 immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the stats-conversions.php file, specifically looking for script-based payloads in parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in incoming HTTP requests until patching is completed.

Public Exploit Available: Unknown.

Given the high CVSS severity and the existence of a proof-of-concept, organizations running Revive Adserver must prioritize applying the provided security updates. Failure to patch allows for a clear pathway to session hijacking, which could lead to full platform compromise and unauthorized data access.