MediumPublic exploit

SQL Injection in Android Download Manager Content Provider

IdentifiersCVE-2018-9493CWE-89· Improper Neutralization of Special…

CVE-2018-9493 is a SQL injection vulnerability in the content provider component of the Android Download Manager. The vulnerability arises from improper input validation, allowing a local attacker to inject arbitrary SQL queries. This affects Android versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.0. No user interaction or additional execution privileges are required for exploitation.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A local attacker can exploit this vulnerability to access sensitive information stored in the Download Manager's database, leading to local information disclosure. The attacker does not require elevated privileges or user interaction, increasing the risk of exploitation by malicious apps running on the device.

Mitigation

If you can’t patch tonight, do this now.

Restrict the installation of untrusted applications and monitor for unusual app behavior. Enterprises can use mobile device management (MDM) solutions to enforce security patch compliance and limit exposure to vulnerable devices.

Remediation

Patch, then assume compromise.

Apply the security updates provided by Google for the affected Android versions. Device manufacturers and users should ensure their devices are updated to the latest available security patch level that addresses this vulnerability.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

AOSP-DownloadProviderDbDumperMaturityPoCVerified exploit

This repository contains a proof-of-concept (PoC) Android application that exploits CVE-2018-9493, a SQL injection vulnerability in Android's Download Provider. The main exploit logic resides in 'app/src/main/java/com/ioactive/downloadProviderDbDumper/MainActivity.java'. The app issues malicious queries to the content provider URI 'content://downloads/my_downloads/' to perform SQL injection and extract sensitive information from the downloads database, including protected columns such as CookieData and ETag. The exploit demonstrates unauthorized access to data by leveraging the vulnerability, and provides a UI to trigger the attack and display results. The repository is structured as a standard Android Studio project, with build scripts, resources, and manifest files. The exploit is operational as a PoC and is not weaponized for automated or remote exploitation, requiring installation and execution on a vulnerable device.

IOActiveDisclosed Mar 2, 2019javaxmllocal

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity