SQL Injection Vulnerability in Nextcloud Android App by Nextcloud
CVE-2019-5454

9.8CRITICAL

Key Information:

Vendor

Nextcloud
Status
Com.nextcloud.client
Vendor
CVE Published:
30 July 2019

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-5454?

A security flaw in the Nextcloud Android app prior to version 3.0.0 enables an SQL injection attack, potentially allowing malicious entities to execute harmful queries that can corrupt local caches. This vulnerability requires users to reset their account settings to restore normal functionality, impacting user experience and security.

Affected Version(s)

com.nextcloud.client 3.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

nextcloud_android
Created by shanika04

References

https://hackerone.com/reports/291764
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.