v1.2
What's Changed?
New Vulnerabilities Added:
1. Fragment Injection
- Added visible fragment into Refer-us activity.
- Added hidden fragment for exploitation.
2. SQLi via exported content provider
- Removed direct SQL queries which were fetching addresses from database.
- Implemented a new content provider named AddressContentProvider which now fetches addresses from database.
- This content provider is exported and extra data can be supplied via intent.
3. Unauthorized data Insertion via Insecure Content Provider
- Implemented AddressContentProvider to write the user supplied data into database via content provider query.
- Set this content provider as exported and allow data insertation via intent extra data.
Bugs Fixed:
- Deeplink not working
- Fixed the broken Deeplink feature.
- Restructured elements in manifest file and improved logic in java code for multiple components
Full Changelog: android...v1.2