Potential disclosure and modification of selection data, SAP security note 1499535

SAP security note 1499535, “Potential disclosure and modification of selection data”, is a note released on December 14, 2010. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit certain functions in selection data by using specially crafted inputs to execute arbitrary database commands. This can allow the attacker to retrieve, modify, or remove data persisted by the system.

Solution

Implement the attached correction instructions or apply the relevant Support Packages.

Alternatively, follow the Correction Instructions.

Reason and prerequisites

The vulnerability arises from an SQL injection flaw where the code constructs SQL statements using unvalidated user input. An attacker can manipulate these statements to access or alter the database unlawfully.