GCVE-1988-2026-0211

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "KL-001-2026-01 yintibao Fun",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "KoreLogic Disclosures via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking\n\nTitle: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking\nAdvisory ID: KL-001-2026-001\nPublication Date: 2026-01-08\nPublication URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt\n\n\n1. Vulnerability Details\n\n     Affected Vendor: yintibao\n     Affected Product: Fun Print Mobile\n     Affected Version: 6.05.15\n     Platform: ARM64 - Android\n     CWE Classification: CWE-926: Improper Export of Android\n                         Application Components\n     CVE ID: CVE-2025-15464\n\n\n2. Vulnerability Description\n\n     Exported Activity allows external applications to gain\n     application context and directly launch Gmail with inbox access,\n     bypassing security controls.\n\n\n3. Technical Description\n\n     * Performed on Android 13 aarch64 - Samsung (Galaxy Tab A7 Lite)\n     * Using Frida client on Ubuntu 24.04 LTS - Frida server on\n       Samsung Rooted Device.\n     * The target Activity is exported true. Which means any\n       application may interact with it, given that permissions are\n       provided.\n     * The attacking host needs to attach the device email to the\n       application; then the account can be used by the application.\n\n     The PandoraEntry activity is exported (android:exported=\"true\")\n     and processes external intents without validation.  Below is\n     the PandoraEntryActivity code:\n\n     protected void onCreate(Bundle bundle) {\n         // ... INITALIZATION CODE ...  super.onCreate(bundle);\n\n         // BELOW EXTERNAL INTENT ACCEPTED WITHOUT VALIDATION Intent\n         intent = getIntent();\n\n         // ... PROCESSING CONTINUES WITH UNVALIDATED INTENT ...\n         if (intent.hasExtra(IntentConst.START_FROM_TO_CLASS) &&\n         SDK.isUniMPSDK()) {\n             String stringExtra =\n intent.getStringExtra(IntentConst.START_FROM_TO_CLASS);\n             if (!TextUtils.isEmpty(stringExtra) &&\n stringExtra.startsWith(\"io.dcloud.feature.sdk.multi\")) {\n                 intent.setClassName(getPackageName(), stringExtra);\n intent.removeExtra(IntentConst.START_FROM_TO_CLASS);\n             }\n         } else {\n intent.putExtra(IntentConst.WEBAPP_SHORT_CUT_CLASS_NAME,\n             PandoraEntry.class.getName()); intent.setClass(this,\n             PandoraEntryActivity.class);\n         }\n\n         //UNVALIDATED INTENT FORWARDED startActivity(intent);\n         overridePendingTransition(0, 0);\n     }\n\n\n4. Mitigation and Remediation Recommendation\n\n     No response from vendor. There are no known mitigations to\n     end-users of the affected application version(s).\n\n5. Credit\n\n     This vulnerability was discovered by Felix Segoviano of\n     KoreLogic, Inc.\n\n\n6. Disclosure Timeline\n\n     2025-12-01 : KoreLogic requests security contact from vendor\n                  via weizhengsl () vip qq com and 277517409 () qq com.\n     2025-12-08 : KoreLogic submits vulnerability details to vendor\n                  via weizhengsl () vip qq com and 277517409 () qq com.\n     2026-01-08 : KoreLogic public disclosure.\n\n\n7. Proof of Concept\n\n     URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt\n     SHA256sum: ddb3c840c94b204fbbe2931a68771ae28d8ea9c778310cfa83e218a64a41ffd5\n\n\n\nThe contents of this advisory are copyright(c) 2026\nKoreLogic, Inc. and are licensed under a Creative Commons\nAttribution Share-Alike 4.0 (United States) License:\nhttp://creativecommons.org/licenses/by-sa/4.0/\n\nKoreLogic, Inc. is a founder-owned and operated company with a\nproven track record of providing security services to entities\nranging from Fortune 500 to small and mid-sized companies. We\nare a highly skilled team of senior security consultants doing\nby-hand security assessments for the most important networks in\nthe U.S. and around the world. We are also developers of various\ntools and resources aimed at helping the security community.\nhttps://www.korelogic.com/about-korelogic.html\n\nOur public vulnerability disclosure policy is available at:\nhttps://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-926",
              "description": "CWE-926",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/12"
        },
        {
          "url": "http://creativecommons.org/licenses/by-sa/4.0/"
        },
        {
          "url": "https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy"
        },
        {
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt"
        },
        {
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.korelogic.com/about-korelogic.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-15464",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0211",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/12",
            "automated": true,
            "contentSha256": "f9ca029e23bb782597524f8956f00ca2dbb1b9215a0823cb7adb2f17a243aa76",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T21:03:37Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0211"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}