Potential disclosure of persisted data in OXT_GENOBJDEF, SAP security note 1495445

SAP security note 1495445, "Potential disclosure of persisted data in OXT_GENOBJDEF", is a program error note released on 12.10.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit the DB table OXT_GENOBJ_DEF and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system.

Solution

Please apply the note.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it.

CVSS

Score 0

References

• SAP Note 1514283: Exception while creating EEWB extension

Affected components

• SAP_ABA: 620, 640, 700-702, 710-730