PT-2018-12318 · Infinix+2 · Infinix X571+2

Hacked0X90 · Publicado 2018-07-15 · Atualizado 2018-09-21 · CVE-2018-14066

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com.android.provider.telephony (affected versions not specified) Infinix X571 (affected versions not specified) Lenovo phones (such as the A7020) (affected versions not specified)

Description The issue allows SQL injection through the content://wappush content provider in com.android.provider.telephony, found in some custom ROMs for Android phones. This enables an application without the READ SMS permission to read SMS messages.

Recommendations For com.android.provider.telephony, consider restricting access to the content://wappush content provider until a fix is available. For Infinix X571 phones, contact the manufacturer for guidance on resolving the issue. For Lenovo phones (such as the A7020), update to the fixed version provided by Lenovo. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Infinix X571 and com.android.provider.telephony.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-14066

Produtos afetados

Infinix X571

Lenovo A7020

Com.Android.Provider.Telephony

Referências · 3

• 🔥 https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14066 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14066 · Aviso do Fabricante