Potential modification in line maintenance function module, SAP security note 1484926

SAP security note 1484926, “Potential modification in line maintenance function module.” Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit the Function Module used to read text tables. This Function Module accepts specially crafted inputs to execute arbitrary database commands, enabling the retrieval, modification, or removal of data persisted by the system.

Solution

The correction involves manual steps that must be performed by the customer:

• Create a Message in SE91: go to transaction SE91 and create message 004 in the message class /ISDFPS/LM_STB_APP with the text “Dieser Funktionsbaustein ist veraltet, bitte nicht verwenden” (German), translated as “The Function Module is obsolete, please do not use” (English).
• Save the modified message class.
• Apply the correction instruction.

Reason and prerequisites

The issue arises from an SQL injection vulnerability. The code constructs an SQL statement incorporating strings that can be manipulated by a malicious user. This manipulation allows the construction of additional SQL commands to retrieve or potentially modify database information.