SAP security note 1499115, “Unauthorized modification of displayed content in Designer UI”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.
Description
Symptom: The Product Designer can be abused by a malicious user, allowing them to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Other Terms: Reflected Cross Site Scripting (XSS), Product Designer
Reason and Prerequisites: Web pages within the Product Designer do not sufficiently encode input and output parameters, resulting in a reflected cross site scripting issue. This vulnerability allows:
- Non-permanent defacement or modification of displayed web content.
- Theft of authentication information related to user sessions.
- Impersonation of users, granting access to information with the same permissions.
- Potential full compromise of the application's security if an administrator is impersonated.
Solution: Implement the provided source code corrections to address the vulnerabilities.
Full note on SAP: SAP Support Launchpad note 1499115
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
