CVE-2018-9493 PoC — Android download manager 信息泄露漏洞

Source

https://github.com/IOActive/AOSP-DownloadProviderDbDumper

Associated Vulnerability

Title:Android download manager 信息泄露漏洞 (CVE-2018-9493)
Description:Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。Download Manager是其中的一个下载管理器。 Android中的download manager的content provider存在信息泄露漏洞，该漏洞源于程序没有执行正确的输入验证。本地攻击者可通过发送特制的请求利用该漏洞获取敏感信息。以下版本受到影响：Android 7.0版本，7.1.1版本，7.1.2版本，8.0版本，8.1版本，9版本。

Description

PoC Exploiting SQL Injection in Android's Download Provider (CVE-2018-9493)

Readme

# AOSP-DownloadProviderDbDumper
PoC Exploiting SQL Injection in Android's Download Provider (CVE-2018-9493)

## Security Advisory
https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf

## More Information
https://ioactive.com/multiple-vulnerabilities-in-androids-download-provider-cve-2018-9468-cve-2018-9493-cve-2018-9546/

File Snapshot


 [4.0K]  /data/pocs/4be1f32e72e8be2294eb758d30bce9896ee73de5
├── [4.0K]  app
│   ├── [ 969]  build.gradle
│   ├── [ 751]  proguard-rules.pro
│   └── [4.0K]  src
│       └── [4.0K]  main
│           ├── [ 835]  AndroidManifest.xml
│           ├── [4.0K]  java
│           │   └── [4.0K]  com
│           │       └── [4.0K]  ioactive
│           │           └── [4.0K]  downloadProviderDbDumper
│           │               └── [5.5K]  MainActivity.java
│           └── [4.0K]  res
│               ├── [4.0K]  drawable
│               │   └── [5.5K]  ic_launcher_background.xml
│               ├── [4.0K]  drawable-v24
│               │   └── [1.8K]  ic_launcher_foreground.xml
│               ├── [4.0K]  layout
│               │   └── [2.1K]  activity_main.xml
│               ├── [4.0K]  mipmap-anydpi-v26
│               │   ├── [ 272]  ic_launcher_round.xml
│               │   └── [ 272]  ic_launcher.xml
│               ├── [4.0K]  mipmap-hdpi
│               │   ├── [3.0K]  ic_launcher.png
│               │   └── [4.9K]  ic_launcher_round.png
│               ├── [4.0K]  mipmap-mdpi
│               │   ├── [2.0K]  ic_launcher.png
│               │   └── [2.8K]  ic_launcher_round.png
│               ├── [4.0K]  mipmap-xhdpi
│               │   ├── [4.5K]  ic_launcher.png
│               │   └── [6.9K]  ic_launcher_round.png
│               ├── [4.0K]  mipmap-xxhdpi
│               │   ├── [6.3K]  ic_launcher.png
│               │   └── [ 10K]  ic_launcher_round.png
│               ├── [4.0K]  mipmap-xxxhdpi
│               │   ├── [9.0K]  ic_launcher.png
│               │   └── [ 15K]  ic_launcher_round.png
│               └── [4.0K]  values
│                   ├── [ 208]  colors.xml
│                   ├── [  87]  strings.xml
│                   └── [ 383]  styles.xml
├── [ 546]  build.gradle
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 53K]  gradle-wrapper.jar
│       └── [ 233]  gradle-wrapper.properties
├── [ 726]  gradle.properties
├── [5.2K]  gradlew
├── [2.1K]  gradlew.bat
├── [ 34K]  LICENSE
├── [ 403]  README.md
└── [  15]  settings.gradle

20 directories, 31 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!