Potential disclosure and modification of persisted data, SAP security note 1599132

SAP security note 1599132, "Potential disclosure and modification of persisted data", is a program error note released on 08.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit persisted data using specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system.

Solution

Please implement the attached correction instructions.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it.