SAP security note 1478756, "Executing any source code in CO-PC reporting", is released on August 10, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Due to an error in the CO summarization (or order summarization), an attacker can execute any user-defined source code. As a result, the attacker can gain control over the system and obtain increased privileges.
Solution
As of Release 6.06, the problem no longer occurs. Implement the attached corrections in advance.
Reason and prerequisites
The program code allows source code that can be determined freely to be added and executed, which enables an attacker to control the system response. Valid logon information and the authorization to execute ABAP reports in CO reporting are required.
Depending on the source code added, the attacker can obtain unauthorized access to data and change or delete it; the attacker can also change system output or create new users, and cause a denial of service.
CVSS
Score 0
References
This note refers to
Affected components
- SAP_APPL 31I
- SAP_APPL 40B
- SAP_APPL 45B
- SAP_APPL 46B
- SAP_APPL 46C
- SAP_APPL 470
- SAP_APPL 500
- SAP_APPL 600
- SAP_APPL 602
- SAP_APPL 603
- SAP_APPL 604
- SAP_APPL 605
Full note on SAP: SAP Support Launchpad note 1478756
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].