JVN#83862346: MEGAPHONE MUSIC vulnerable to URL whitelist bypass

MEGAPHONE MUSIC provided by Newphoria Corporation Inc. is an application for both iOS or Android built using “applican”. MEGAPHONE MUSIC contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme.

Impact

Android version of this app may allow an applican API to be executed if that API has been granted permission in the android manifest.
iOS version of this app may allow an arbitrary API to be executed.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• MEGAPHONE MUSIC for Android versions 1.0 and earlier
• MEGAPHONE MUSIC for iOS versions 1.0 and earlier