SAP security note 1509064, "Possible disclosure of data in function grp BCA_API_CN_CTRL". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can make specific entries in the function modules BCA_API_CHECK_TABLE_VAL_EXISTS, BCA_API_CN_CTRL_CHCKTAB_VAL_EX, BCA_API_CN_CTRL_CHCKTAB_VAL_GE, and BCA_CHECK_TABLE_VALUE_EXISTS in the function group BCA_API_CN_CTRL to disclose additional data or to change data saved in the database.
Solution
Import the relevant Support Package for your release. Use transaction SNOTE to implement the attached correction instructions in advance.
You do not have to perform any manual tasks.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The resulting complete statement can then be manipulated and used to modify data in the database or to output additional data.
Affected components
- FSAPPL (Versions 100, 200, 300)
- BANK-TRBK (Versions 30, 40)
Full note on SAP: SAP Support Launchpad note 1509064
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].