Home

Description

EN DE

A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper export of android application components. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and replied: "After reviewing your report, we have confirmed that this vulnerability does indeed exist and we are actively working to fix it."

In AfterShip Package Tracker App bis 5.24.1 auf Android wurde eine Schwachstelle gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei AndroidManifest.xml der Komponente com.aftership.AfterShip. Die Veränderung resultiert in improper export of android application components. Der Angriff muss lokal angegangen werden. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.

PUBLISHED Reserved 2025-08-19 | Published 2025-08-19 | Updated 2025-08-19 | Assigner VulDB




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
MEDIUM: 5.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
4.3AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C

Problem types

Improper Export of Android Application Components

Product status

5.24.0
affected

5.24.1
affected

Timeline

2025-08-19:Advisory disclosed
2025-08-19:VulDB entry created
2025-08-19:VulDB entry last update

Credits

fxizenta (VulDB User) reporter

References

vuldb.com/?id.320514 (VDB-320514 | AfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application components) vdb-entry

vuldb.com/?ctiid.320514 (VDB-320514 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.615253 (Submit #615253 | Aftership(https://www.aftership.com/mobile-app) AfterShip 5.24.1 Task Hijacking) third-party-advisory

github.com/...droidapps/blob/main/com.aftership.AfterShip.md related

github.com/...droidapps/blob/main/com.aftership.AfterShip.md exploit

cve.org (CVE-2025-9134)

nvd.nist.gov (CVE-2025-9134)

Download JSON