SAP security note 1517341, "Potential disclosure and modification of persisted data", is a program error note released on 14.12.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can change, output, or delete any data by making specific entries in the function module BCA_TBBW_ADMIN_TIMESTAMPS.
Solution
Call transaction SE37 and delete the function module BCA_TBBW_ADMIN_TIMESTAMPS.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The resulting complete statement can then be manipulated and used to modify data in the database or to output additional data.
Full note on SAP: SAP Support Launchpad note 1517341
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
