SAP security note 1511436, "Code Injection Vulnerability in Relationship and Reliability", is a note released on December 14, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
CRM ICM Relationships and Reliability contains code that allows the execution of arbitrary program code of the user’s choice. A malicious user can control the system’s behavior or potentially escalate privileges by executing malicious code without legitimate credentials.
Solution
To address this issue, implement the attached correction instruction using SNOTE. You can download the correction instructions here.
Reason and prerequisites
The program code allows users to define and execute custom code, altering the system’s behavior. A valid and authenticated user is required. Depending on the injected code, users can:
- Obtain unauthorized information
- Modify or delete data
- Change system output
- Create new users with elevated privileges
- Perform denial of service attacks
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1511436
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].