MEGAPHONE MUSIC vulnerable to URL whitelist bypass


MEGAPHONE MUSIC provided by Newphoria Corporation Inc. is an application for both iOS or Android built using "applican". MEGAPHONE MUSIC contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme.

Kenta Suefusa and Tomonori Shiomi of Sprout Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

Base Metrics: 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial

Affected Products

Newphoria Corporation
  • MEGAPHONE MUSIC for Android versions 1.0 and earlier
  • MEGAPHONE MUSIC for iOS versions 1.0 and earlier


Android version of this app may allow an applican API to be executed if that API has been granted permission in the android manifest.
iOS version of this app may allow an arbitrary API to be executed.

[Update the Software]
Update to the latest version according to the information provided by the developer.
Vendor Information

Newphoria Corporation
CWE (What is CWE?)

  1. Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2015-5634

  1. JVN : JVN#83862346
  2. National Vulnerability Database (NVD) : CVE-2015-5634
Revision History

  Web page was published
  References : Content was added