Andrés Ramos

**اسم البرنامج المصاب والإصدارات المتأثرة** PingTools Network Utilities الإصدار 4.64 **Description** يحتوي التطبيق على ثغرة حقن أوامر نظام التشغيل ضمن خدمة Watcher ICMP. يمكن للمهاجم المحلي القادر على إنشاء أو تعديل خدمة Watcher إدخال قيمة 임의 في حقل `Host`. يتم إلحاق هذه القيمة بأمر ping، ثم تسلسل الأمر كسلسلة نصية واحدة وتنفيذه عبر `sh -c` مما يسمح بتنفيذ أوامر 임의 بمعرف المستخدم (UID) الخاص بالتطبيق وصلاحيات Android الممنوحة له. **Recommendations** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.

**Name of the Vulnerable Software and Affected Versions** ExifTool for photo and video version 5.0.1-gms **Description** The application constructs shell command strings using file paths and executes them via `/system/bin/sh -c`. During the CSV-export process, the selected media path is enclosed in single quotes without escaping embedded single quotes, which allows for command injection. **Recommendations** Update ExifTool for photo and video to a version where file paths are properly sanitized or escaped before being passed to the shell.

**Name of the Vulnerable Software and Affected Versions** Secure Folder version 1.2 **Description** Files selected for the password-protected vault are stored as unencrypted files within the Android shared-storage tree. This allows a local application or file manager with access to the shared-storage path to enumerate, copy, and open these files without authenticating to the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Root Browser Classic version 3.3.0 **Description** Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for command injection, where an attacker could execute arbitrary commands on the system by manipulating the database path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The application uses a calculator-style vault passcode to protect access, but the stored data is not bound to this authentication boundary. A local actor with access to shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with appropriate storage access, can bypass the passcode by copying the SQLite database and media files directly. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gallery - Private Photo Vault version 1.0.41 **Description** The application starts an unauthenticated HTTP server accessible from the local network. This server listens on TCP port 8080 and allows the retrieval of files and directory listings from the Android external storage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ekia File Manager version 1.2.7 **Description** The application exposes `com.ekia.filecontrolmanager.OpenFileProvider` as an exported Android ContentProvider without requiring caller permissions. The provider maps a caller-controlled URI path directly to a filesystem path and passes it to the `new File(...)` function. It supports `query()`, `openFile()`, and `delete()` operations. Since the provider lacks `android:permission`, `android:readPermission`, or `android:writePermission`, a local application can access the provider authority to read, create, overwrite, or delete files accessible to the File Manager process. **Recommendations** Update Ekia File Manager to a version newer than 1.2.7. As a temporary mitigation, restrict access to the `com.ekia.filecontrolmanager.OpenFileProvider` component.