Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Potential deletion of persisted data, SAP security note 1481356

SAP Note 1481356SAP Security NoteHigh priority

SAP security note 1481356, "Potential deletion of persisted data", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCustomer Relationship Management > Marketing > Digital Asset Management
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on14.12.2010
LanguageEnglish

Description

Symptom

A malicious user can use specially crafted customizings to remove data persisted by the system.

Solution

Apply the note or corresponding service pack.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to potentially remove data.

Affected components

  • BBPCRM: Versions 500, 520, 600, 700, 701

Full note on SAP: SAP Support Launchpad note 1481356

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SQL injection#database

Explore More