Skip links
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Hard-coded user name in article maintenance, SAP security note 1485492

SAP Note 1485492

SAP security note 1485492, "Hard-coded user name in article maintenance". Below are the symptom and SAP recommended solution.

Description

Symptom

A hard-coded user name can change the system behavior if a user is authenticated to the system using this name.

Solution

Implement the attached corrections.

Reason and prerequisites

The program source code contains a hard-coded user name. If a user successfully logs on to the system with this name, an undesired additional function that was implemented for test purposes only may be executed. Calling the additional function has no direct effects, as only data that is not then processed further is returned to the calling program. In extreme cases, the additional function only slightly increases the runtime of the application.

Full note on SAP: SAP Support Launchpad note 1485492

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

Explore More