CVE-2014-8507

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.6%

from disclosure to weapon0 days

Published on NVDDec 15

1st PoCNov 26

exploitation probability

1.6%top 27% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/35382unverified cve_referencepacketstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.html https://android.googlesource.com/platform/frameworks/base/+/48ed835468c6235905459e6ef7df032baf3e4df6 http://seclists.org/fulldisclosure/2014/Nov/86 http://www.securityfocus.com/bid/71310 http://xteam.baidu.com/?p=167