← volver
CVE-2014-8507

CVE-2014-8507

EPSS 1.6%
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135.
Productos afectados
n/a · n/a
PoCs públicas encontradas — 2
cve_referencepacketstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.htmlno verificadoexploitdbwww.exploit-db.com/exploits/35382no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
http://packetstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.htmlhttps://android.googlesource.com/platform/frameworks/base/+/48ed835468c6235905459e6ef7df032baf3e4df6http://seclists.org/fulldisclosure/2014/Nov/86http://www.securityfocus.com/bid/71310http://xteam.baidu.com/?p=167