CVE-2014-8507 | BDVDB-2026-66787 Detail

Description#

Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://seclists.org/fulldisclosure/2014/Nov/86
https://android.googlesource.com/platform/frameworks/base/+/48ed835468c6235905459e6ef7df032baf3e4df6
http://packetstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.html
http://xteam.baidu.com/?p=167
http://www.securityfocus.com/bid/71310

Exploit#

No public exploit known

History#

Version 12014-12-15Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.