Potential change/disclosure of persisted data, SAP security note 1598806

SAP security note 1598806, "Potential change/disclosure of persisted data". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit EH&S and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

The "Reference to Support Packages" section specifies the Support Packages that contain the corrections.

Alternatively, you can implement the attached correction instructions. Apart from implementing the correction instructions, no further measures are necessary.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify the data.