Saved data may be disclosed and changed, SAP security note 1469707

SAP security note 1469707, "Saved data may be disclosed and changed", released on August 10, 2010. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can use an RFC module to change, display, or delete any data by making specific entries.

Solution

When you implement this note, the critical source code is commented out. The affected module is obsolete, and the security hole is closed in this way.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. In the source code, an SQL statement is composed of strings. In this case, an attacker can obtain control of the contents of a substring. As a result, the attacker can manipulate the entire resulting statement and, therefore, execute all SQL commands with the authorizations of the database user that is logged on.