FPB_PERSONALIZATION SQL injection vulnerability removed, SAP security note 1495272

SAP security note 1495272, "FPB_PERSONALIZATION: SQL injection vulnerability removed", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit programs FPB_COPY_FPB_USER, FPB_EXPORT_FPB_USER, and FPB_IMPORT_FPB_USER and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system.

Solution

Apply the appropriate correction instruction attached or the corresponding Support Package.

Note that after applying the corrections, users that need to execute the affected programs now need authorization for authorization object S_CTS_ADMI with ID CTS_ADMFCT and field TABL.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it.