Potential modification or disclosure of persisted data, SAP security note 1456132

SAP security note 1456132, "Potential modification or disclosure of persisted data", is a program error note released on 12.05.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit the NetWeaver-based audit trail and use specially crafted inputs to disclose additional data or change data that is saved in the database.

Solution

Implement the correction instructions relevant for your release in your system. Save and activate your changes.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database, or to modify the data.