CVE-2019-2196 PoC — Android Framework组件SQL注入漏洞

Source

https://github.com/IOActive/AOSP-DownloadProviderDbDumperSQLiLimit

Associated Vulnerability

Title:Android Framework组件SQL注入漏洞 (CVE-2019-2196)
Description:In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269143

Description

PoC Exploiting SQL Injection in Android's Download Provider in Sort Parameter (CVE-2019-2196)

Readme

# AOSP-DownloadProviderDbDumperSQLiLimit
PoC Exploiting SQL Injection in Android's Download Provider in Sort Parameter (CVE-2019-2196)

## Security Advisory
[Android (AOSP) Download Provider SQL Injection in Query Sort Parameter (CVE-2019-2196)](https://act-on.ioactive.com/acton/attachment/34793/f-5c01ebda-2cb5-47b9-9330-2d71b3a34db6/1/-/-/-/-/cve-2019-2196.pdf)

## Demo
![PoC video](demo.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!