SAP Security Note
HotNews
SAP security note 1168813, "Security note: Program DISPLAY_FUNC_INCLUDE", is a program error note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The program DISPLAY_FUNC_INCLUDE does not have an authorization check.
Solution
A developer authorization check and a check for the changeability of the system should be included in the program. Implement the attached correction instructions. The program is deleted with the Support Packages specified in this note. The corrections do not influence the normal functioning of the application.
Recommendation: It is strongly recommended to implement this note to eliminate the identified security flaw.
Reason and prerequisites
You can use the program DISPLAY_FUNC_INCLUDE as an alternative, restricted editor for function module includes.
References
This note refers to
Affected components
- SAP_BASIS: From 700 To 700
- SAP_BASIS: From 710 To 710
Full note on SAP: SAP Support Launchpad note 1168813
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].