PM ES Potential disclosure and modification of DB data, SAP security note 1503358

SAP security note 1503358, “PM ES: Potential disclosure and modification of DB data”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

A malicious user can exploit the enterprise service MaintenanceTaskListERPSimpleByElementsQueryResponse_In_V1 and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to modify the data.

Solution

Implement the attached correction instructions.