CVE-2025-7890
📋 TL;DR
This vulnerability in the Dunamu StockPlus Android app allows improper export of application components via AndroidManifest.xml manipulation. Attackers with local access can exploit this to access sensitive app functionality or data. Only Android users of the affected app versions are impacted.
💻 Affected Systems
- Dunamu StockPlus App
📦 What is this software?
Stockplus by Dunamu
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains unauthorized access to sensitive app components, potentially accessing financial data or performing unauthorized transactions within the app.
Likely Case
Local attacker accesses non-critical app components or functionality, potentially compromising user privacy or app integrity.
If Mitigated
With proper Android security controls and app sandboxing, impact is limited to the specific app's data and functionality.
🎯 Exploit Status
Exploit requires local access to device; public disclosure includes reproduction steps but no vendor response.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor app updates from Google Play Store and update when available.
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove the vulnerable StockPlus app from affected devices
adb uninstall com.dunamu.stockplus
Restrict app permissions
androidLimit app permissions in Android settings to reduce potential impact
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement mobile device management (MDM) controls to monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check app version in Android settings > Apps > StockPlus > App info. If version is 7.62.10 or lower, device is vulnerable.Check Version:
adb shell dumpsys package com.dunamu.stockplus | grep versionNameVerify Fix Applied:
Verify app version is above 7.62.10 after update from Google Play Store.📡 Detection & Monitoring
Log Indicators:
- Unusual app component access attempts in Android logs
- Suspicious activity from StockPlus app
Network Indicators:
- Unusual network traffic from StockPlus app to unexpected destinations
SIEM Query:
source="android_logs" AND app="com.dunamu.stockplus" AND (event="component_export" OR event="permission_violation")🔗 References
- https://github.com/KMov-g/androidapps/blob/main/com.dunamu.stockplus.md
- https://github.com/KMov-g/androidapps/blob/main/com.dunamu.stockplus.md#steps-to-reproduce
- https://vuldb.com/?ctiid.317005
- https://vuldb.com/?id.317005
- https://vuldb.com/?submit.615270
- https://github.com/KMov-g/androidapps/blob/main/com.dunamu.stockplus.md
- https://github.com/KMov-g/androidapps/blob/main/com.dunamu.stockplus.md#steps-to-reproduce
