CVE-2018-14066: SQL Injection

Published Jul 15, 2018

Updated

The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READSMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo phones (such as the A7020) that have since been fixed by Lenovo.

Affected Software

4 affected components

Google Android=7.0

Infinixmobility Infinix X571

Google Android=6.0

Lenovo Lenovo A7020

Event History

Jul 15, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is CVE-2018-14066?

CVE-2018-14066 is a vulnerability in the content://wappush content provider in com.android.provider.telephony, which allows SQL injection.

What is the severity of CVE-2018-14066?

The severity of CVE-2018-14066 is critical with a CVSS score of 9.8.

Which software versions are affected by CVE-2018-14066?

Google Android 7.0 and 6.0 are affected by CVE-2018-14066.

How does CVE-2018-14066 impact Infinix X571 phones?

CVE-2018-14066 allows an application without the READ_SMS permission to read SMS messages on Infinix X571 phones.

Where can I find more information about CVE-2018-14066?

More information about CVE-2018-14066 can be found at the following link: [https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage/](https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage/)