SAP security note 1443712, "Potential disclosure and modification of persisted data". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the generation of the numbering schema using SQL Injection by providing specially crafted inputs. This can lead to the execution of arbitrary database commands, allowing the retrieval, modification, or removal of data persisted by the system.
Solution
To address this issue, please implement the attached corrections or apply the appropriate support package.
Reason and prerequisites
The vulnerability arises from an SQL injection flaw. The code constructs an SQL statement that includes strings susceptible to manipulation by a malicious user. This manipulated SQL statement can then be used to extract additional information from the database or potentially alter it.
Affected components
- PPS 1.0
- PPS 2.0
- PPS 3.0
Full note on SAP: SAP Support Launchpad note 1443712
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].