SAP security note 1471687, "Directory traversal in VKT_READ_FORM_AC", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An error in the function module VKT_READ_FORM_AC allows any files to be read using the network.
Solution
Implement this note. The function module is no longer used; it is turned into a comment.
Reason and prerequisites
There is an error in the function module VKT_READ_FORM_AC when checking paths which the server uses to import files. By changing the path, a malicious user can open any file and view its content.
CVSS
Score 0
References
Affected components
- Financial Services > Collections and Disbursements
Full note on SAP: SAP Support Launchpad note 1471687
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].