SAP Security Note
Low priority
SAP security note 1465138, "Change mode in SAT / SE30 "Tips & Tricks"", is a program error note released on August 10, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
In the "Tips & Tricks" of transaction SAT (or transaction SE30 in older releases), you can enter and execute ABAP source code if you have developer authorization S_DEVELOP (activity 02). This could be abused by malicious users to gain unauthorized access or produce incorrect behavior.
Solution
The specified Support Package deactivates change mode in the "Tips & Tricks".
Reason and prerequisites
It does not make sense to create ABAP source text from the documentation, even if you have the relevant authorization. Therefore, we are withdrawing the function. An advance correction is not available due to its large scope and low risk.
Full note on SAP: SAP Support Launchpad note 1465138
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].