Potential disclosure of persisted data in correspondence, SAP security note 1498625

SAP security note 1498625, “Potential disclosure of persisted data in correspondence”, is a note. Below is the security information published by SAP for this note.

Description

Overview

A potential SQL injection vulnerability exists in the new correspondence tool, allowing malicious users to execute arbitrary database commands. This can lead to the retrieval, modification, or removal of data persisted by the system.

Symptom

A malicious user can exploit the new correspondence tool and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system.

Solution

Implement the correction instructions or apply the respective support package provided by SAP.