SAP security note 1509344, "Potential disclosure and modification of persisted data", was released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the Production and Revenue Accounting (PRA) component using specially crafted inputs to execute arbitrary database commands. This allows the retrieval, modification, or removal of data persisted by the system.
Solution
Applying this security note will protect the PRA application by addressing the following vulnerability:
- Dynamic SQL Injection
Reason and prerequisites
The vulnerability is caused by a SQL injection flaw. The application constructs SQL statements using strings that can be manipulated by a malicious user, enabling unauthorized access to or modification of the database.
Affected components
- IS-OIL 600, 602, 603
- IS-PRA 604, 605
Full note on SAP: SAP Support Launchpad note 1509344
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].