Potential modification/disclosure of persisted data i.CRM-IT, SAP security note 1590831

SAP security note 1590831, "Potential Modification/Disclosure of Persisted Data in CRM-IT", is released on November 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit CRM-IT-BTX and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

Implement the attached corrections provided in this security note.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify the data.

Affected components

• BBPCRM 701