A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier.