SAP security note 1489976, "Data can be displayed without authorization", is a program error note released on 12.10.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
By executing an internal standalone report, an attacker can display data from database tables even without the relevant authorization.
Unauthorized access to sensitive data by exploiting the SQL injection vulnerability.
Solution
Implement the advanced corrections as per the correction instructions or import the relevant Support Package.
Reason and prerequisites
This vulnerability is due to an SQL injection security flaw.
Full note on SAP: SAP Support Launchpad note 1489976
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].