SAP security note 1494203, “Unauthorized Modification of Displayed Content in CRMCMP_PWP”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.
Description
The CRMCMP_PWP BSP application is vulnerable to unauthorized modifications by malicious users. This vulnerability allows attackers to alter displayed application content without proper authorization and potentially steal authentication information from legitimate users.
Symptom
A malicious user can exploit the CRMCMP_PWP application to modify content displayed in the application. This unauthorized modification can lead to the theft of authentication information, allowing attackers to impersonate users and access sensitive data.
Reason and prerequisites
The BSP pages CRMCMP_PWP\session_buffered_frame.htm and CRMCMP_PWP\session_single_frame.htm do not adequately encode input parameters. This deficiency results in a reflected cross-site scripting (XSS) vulnerability. An attacker can leverage this vulnerability to deface or modify website content and steal user authentication information.
Solution
To address this security issue, apply the attached correction or install the relevant support package.
Full note on SAP: SAP Support Launchpad note 1494203
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].