# SQLi allow query restriction bypass on exposed FileContentProvider

SQL injection in Nextcloud Android FileContentProvider projection allows any app to dump all tables in filelist.db, leaking share tokens and owner data.

- Payout: $100
- Severity: low
- Program: Nextcloud
- Credited: doragon
- Disclosed: 2019-07-29
- CVE: CVE-2019-15622
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/518669
- Library page: https://bugbountylibrary.com/r/h1%3A518669
- Tags: domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:low tech:android technique:source-review vuln:access-control vuln:sqli

**Target:** Nextcloud Android app FileContentProvider (content://org.nextcloud/file)
**Root cause:** Projection restriction (isCallerNotAllowed / projectionArray check) is only enforced for ROOT_DIRECTORY URI, not for SINGLE_FILE/DIRECTORY, so attacker-controlled projection is passed to SQLite query.
**Steps:**
1. Identify exported FileContentProvider in com.nextcloud.client (content://org.nextcloud/file).
2. Note switch at l444 allows SINGLE_FILE/DIRECTORY without caller check; projection sanitization only at l577 for ROOT_DIRECTORY.
3. Run `content query --uri content://org.nextcloud/file --projection "* from ocshares --"` from another app.
4. Observe leaked rows from ocshares including token, owner_share, path.
5. Forge share URL https://host/index.php/s/<token> to access shared file.
**How found:** Code review of FileContentProvider: noticed the switch at l444 permits SINGLE_FILE/DIRECTORY without isCallerNotAllowed, and that projection sanitization at l577 is gated on ROOT_DIRECTORY only, implying projection flows unsanitized into the SQLite query.
**Exploitation:** Malicious app on device issues a content provider query with a crafted projection that injects a subquery/UNION-style clause (`* from ocshares --`), bypassing the intended column restriction and dumping arbitrary tables in filelist.db; leaked share tokens allow constructing valid public share links.
**Escalation:** Any table in filelist.db is dumpable, enabling broader data disclosure beyond shares (accounts, files metadata).
**Insight:** When a content provider sanitizes projections, check whether the sanitization is gated on a specific URI match case; sibling URI cases in the same switch often skip the check, letting attacker-controlled projection reach raw SQLite.