Editing Avcontent.db. Arbitrary Delete.
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 1: | Line 1: | ||
== Introduction == | == Introduction == | ||
This is a disclosure of an vulnerability | This is a disclosure of an vulnerability i (SilicaAndPina) discovered back in 2019. | ||
The PlayStation Vita has a few apps for displaying various media formats. | The PlayStation Vita has a few apps for displaying various media formats. | ||
| Line 9: | Line 9: | ||
== Arbitrary Delete == | == Arbitrary Delete == | ||
using this you can delete any file from any *writable* partition on the PSVita. | using this trick you can delete any file from any *writable* partition on the PSVita. | ||
By editing the tbl_VPContent inside avcontent.db you can change the path of any media contents to be whatever path you want | |||
By editing the tbl_VPContent inside avcontent.db you can change the | if you then delete it inside the app, it will not only delete the entry from the database, but it will delete that underlying file as well. | ||
if you then delete it inside the | |||
but it will delete that underlying file as well. | |||
== Arbitrary Read == | == Arbitrary Read == | ||
Using the videos app i was able to read arbitrary files by changing the path in the avcontent.db, | |||
and then copying it with CMA, however this only worked with files inside ux0: | |||
files outside there would not work. | |||
Using the | |||
and then copying it with CMA, however this only worked with files inside ux0: | |||
files outside there would not work. | |||
other stuff i tried: | |||
- doing it on a photo, and trying to "Upload" it to a website, but the web browser is sandboxed so this did not work. | |||
- Attaching a injected photo to an email and sending it, didnt seem to work, just 0bytes possibly [[FailMail]] lead to this being fixed?? | - Attaching a injected photo to an email and sending it, didnt seem to work, just 0bytes possibly [[FailMail]] lead to this being fixed?? | ||
== Exploitation == | == Exploitation == | ||
Ultimately this trick is kinda useless, it requires having access to the memory card to write a hacked avcontent.db in the first place, which if you had you can delete whatever you want anyway? | Ultimately this trick is kinda useless, it requires having access to the memory card to write a hacked avcontent.db in the first place, which if you had you can delete whatever you want anyway? | ||