Converting data access for third-party collection, SAP security note 1494631

SAP security note 1494631, “Converting data access for third-party collection.” Below are the symptom and SAP recommended solution.

Description

Symptom

Some data accesses do not meet the required security standards. As a result, an attacker may be able to change, display, or delete any data in the system by making specific entries in the third-party collection.

Solution

For an advanced correction, implement the source code corrections and perform the manual tasks outlined below.

Reason and prerequisites

The problem may be caused by an SQL injection vulnerability. In the source code, an SQL statement is constructed using strings. An attacker may be able to gain control over the contents of a substring. Using the substring, the attacker may manipulate the entire statement and execute all SQL statements with the privileges of the database user that is logged on.