Potential disclosure and modification of persisted data, SAP security note 1599431

SAP security note 1599431, “Potential disclosure and modification of persisted data”, is a security note released on 08.11.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit persisted data from the Consolidated Database using specially crafted inputs to execute arbitrary database commands in function modules of certain upgrade packages to retrieve, modify, or remove data persisted by the system.

Solution

Please implement the attached correction instructions.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement dynamically including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it.

CVSS

Score 0

References

• 709950 – Performance Problem in UPDATE_DB_COMP_TABLES
• 902590 – Performance of upgrade report PAS_MATNRLNG_MIGRATION
• 1487906 – Missing authorization check in Employee Migration Program

Affected components

• BBPCRM, versions 400, 500, 520, 600, 700, 701