Dynamic SQL Statements Giving Rise to Security Concerns, SAP security note 1501635

SAP security note 1501635, “Dynamic SQL Statements Giving Rise to Security Concerns”, was released on 12.10.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Some dynamic SQL statements in the BCA module allow user input to be directly incorporated, enabling malicious users to inject SQL clauses and access unauthorized information. It can be challenging to identify if user input is included in dynamic SQL statements, making them a security risk. Therefore, it’s recommended to avoid using dynamic SQL statements when possible.

Exploiting this vulnerability, an attacker could manipulate SQL queries to retrieve sensitive data, potentially compromising the security and integrity of the system.

Solution

Apply the provided corrections in SAP Note 1501635. Ensure that you follow the correction instructions carefully:

• Delete Report and Function Modules:
  • Use transaction SE38 to delete report RFBKXPR402_13 without setting the ‘Includes’ option.
  • Use transaction SE37 to delete the following function modules:
    • BKK_ACCNT_GET_FREE_SELECTION (Function Group FBK8)
    • BKK_ACNT_GET_FREE_SEL_WITH_TAB (Function Group FBK8)
    • BKK_PA_REST_DB_GET (Function Group FBMF)
    • BKK_PA_WORK_DB_GET (Function Group FBMF)
    • BKK_PAYM_ORDER_GET_LIST (Function Group FBP1)

Affected components

• IS-B-BCA within various EA-FINSERV releases