Potential modif. or disclosure of data in SAP SNC, SAP security note 1493519

SAP security note 1493519, “Potential modification or disclosure of data in SAP SNC”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.

Description

Symptom

A malicious user can exploit SAP SNC and use specially crafted inputs to modify database commands, resulting in either the retrieval of additional information or modification of data persisted by the system.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or modify it.

Solution

Please implement the correction instruction below.

Affected components

• Component: SCM-APO-MD (Supply Chain Management > Advanced Planning and Optimization > Master Data)