CVE-2025-5154 in PhonePe App
Summary
by MITRE • 05/25/2025
A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The attack needs to be performed locally. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The root-requirement of the attack is reflected by the CVSS vector attribute PR:H. The vendor explains: "[A]s per the PoC this vulnerability needs a rooted device to exploit. PhonePe does not consider vulnerabilities found in rooted device as valid because there is not real-world exploit scenario."
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
This vulnerability represents a critical security flaw in the PhonePe mobile application where sensitive data is stored in cleartext within the SQLite database component. The issue exists within the Android-specific database directory structure at /data/data/com.phonepe.app/databases/ and affects version 25.03.21.0 of the application. The vulnerability classification as problematic indicates that it presents a significant risk to user data confidentiality and could potentially expose sensitive financial information to unauthorized parties. The cleartext storage vulnerability falls under the CWE-312 category, which specifically addresses the exposure of sensitive information through cleartext storage, making it particularly dangerous in financial applications where user transaction data, account information, and personal identifiers are typically stored.
The technical exploitation of this vulnerability requires local access to the device, meaning an attacker must already have physical or administrative access to the target smartphone. This local privilege requirement does not mitigate the severity of the issue, as mobile devices are often compromised through various attack vectors including phishing, malicious applications, or device theft. The fact that this exploit has been publicly disclosed significantly increases the risk to users, as it provides attackers with specific information about how to target this particular weakness. The vulnerability manifests in the database component where sensitive information is not properly encrypted before being written to disk, creating persistent exposure windows for any data stored in the application's local database.
The operational impact of this vulnerability extends beyond simple data exposure, as it fundamentally undermines the security model of a financial application that users trust to protect their monetary transactions and personal information. Mobile financial applications like PhonePe handle highly sensitive data including payment histories, account balances, transaction records, and potentially personal identification information. When this data is stored in cleartext, it becomes immediately accessible to any process running with appropriate privileges on the device, including malware, other applications, or even unauthorized users who gain physical access to the device. This creates a persistent risk where data remains vulnerable even after the application is closed or the device is rebooted.
From a cybersecurity perspective, this vulnerability aligns with the ATT&CK framework's technique T1552.001, which covers "Credentials in Files" and represents a common attack pattern where adversaries seek to obtain sensitive information from local storage. The cleartext storage issue also relates to multiple MITRE ATT&CK techniques including T1005 (Data from Local System) and T1021.001 (Remote Services). Security professionals should consider implementing additional layers of protection such as database encryption, secure coding practices, and regular security assessments to prevent similar vulnerabilities from occurring in mobile applications. The disclosure of this exploit demonstrates the importance of proactive vulnerability management and the need for organizations to maintain robust security practices throughout their application lifecycle to prevent the exposure of sensitive data through cleartext storage mechanisms.