The SRM Live auction application could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Due to a vulnerability that exists in the SRM Live Auction Cockpit application it is possible for a hacker to inject malicious code at runtime which can allow them to steal the current logged on user’s data and perform unauthorized actions without the knowledge of the logged in user.

Vulnerability Details:

The hacker can enter a executable HTML or JAVAScript command into the input fields and save it to the database. Once page which display this data is visited by a user for a legitimate business purpose, the JAVAScript command contained in the database will be executed thereby allowing the hacker to receive the data in the current context or modify the data in the current context or execute critical actions without the knowledge of the legitimate logged in user.

Affected Releases:

SAP SRM 7.01