Airscanner Mobile Security Advisory #07101401 – Mobile-spy.com’s user administration web application contains a critical bug that allows anyone to inject spoofed incoming/outgoing phone records, SMS messages, and URL’s into the backend database for ANY user of the software. In addition, since the incoming records are not filtered, it is trivial to inject malicious JavaScript/HTML into the webpage viewed by the user of the software. Finally, the user/pass is stored locally on the victims phone as plaintext.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/60340/07101401_mobilespy.txt
Source: https://packetstormsecurity.com/files/60340/07101401_mobilespy.txt.html