CVE-2014-8507
Android < 4.4.4 - SQL Injection via WAPPushManager PDU Fields
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-8507. PoCs published by Baidu X-Team.
AI-analyzed exploit summary This writeup details a SQL injection vulnerability in Android <5.0's WAPPushManager, allowing attackers to remotely launch arbitrary activities or services via malformed WAPPush messages. The exploit leverages unescaped SQL queries in the `queryLastApp` method to manipulate intent components.
Description
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135.
Exploits (1)
This writeup details a SQL injection vulnerability in Android <5.0's WAPPushManager, allowing attackers to remotely launch arbitrary activities or services via malformed WAPPush messages. The exploit leverages unescaped SQL queries in the `queryLastApp` method to manipulate intent components.