PT-2018-12318 · Infinix+2 · Infinix X571+2

Hacked0X90 · Published 2018-07-15 · Updated 2018-09-21 · CVE-2018-14066

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com.android.provider.telephony (affected versions not specified) Infinix X571 (affected versions not specified) Lenovo phones (such as the A7020) (affected versions not specified)

Description The issue allows SQL injection through the content://wappush content provider in com.android.provider.telephony, found in some custom ROMs for Android phones. This enables an application without the READ SMS permission to read SMS messages.

Recommendations For com.android.provider.telephony, consider restricting access to the content://wappush content provider until a fix is available. For Infinix X571 phones, contact the manufacturer for guidance on resolving the issue. For Lenovo phones (such as the A7020), update to the fixed version provided by Lenovo. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Infinix X571 and com.android.provider.telephony.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-14066

Affected Products

Infinix X571

Lenovo A7020

Com.Android.Provider.Telephony

References · 3

• 🔥 https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14066 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14066 · Vendor Advisory