SAP security note 1361038, "Report RJ-JXINI generates unnecessary source code", is a program error note released on 14.04.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The report RJ-JXINI reads the field GSTRU from the Customizing table TMC4 and expects the name of a table in this field. It uses this information to generate a second report that deletes all contents of the specified table as an initialization step. If TMC4-GSTRU contains additional SQL statements beyond the table name, unexpected actions may be performed in the database.
Solution
Implement the corrections specified in the correction instructions provided in SAP Note 1361038. The report RJ-JXINI will be modified to use dynamic database statements instead of generating ABAP source code, thereby preventing unintentional database actions due to incorrect entries in TMC4-GSTRU.
Reason and prerequisites
The report RJ-JXINI unnecessarily generates and executes ABAP source code through dynamic ABAP statements. This poses a risk if users have IS-Media-specific authorizations and access to the TMC4 table. To execute RJ-JXINI, a user requires authorization for the authorization object S_PROGRAM (authorization group JVISLONE) and M_NEUA_AUS (application J1).
References
- Automatic checks for security notes using RSECNOTE (outdated)
- Report RJ-J3INI generates source code unnecessarily
- Collective Security Note
Affected components
- IS-M: Versions 3.04 to 604
Full note on SAP: SAP Support Launchpad note 1361038
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
