Code injection vulnerability in CRM_UBB_LAE_EDIT_CONTENT, SAP security note 1568674

SAP security note 1568674, "Code injection vulnerability in CRM_UBB_LAE_EDIT_CONTENT", is a program error note released on 12.07.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The function module CRM_UBB_LAE_EDIT_CONTENT contains code that permits the change of arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system, or can potentially escalate privileges by executing malicious code, without having their own legitimate credentials.

Solution

Implement the correction in accordance with the correction instructions. The corrections do not affect the normal functions of the application.

Reason and prerequisites

The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is required. Depending on the code, the user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Modify data, delete data
• Modify the output of the system
• Create new users with higher privileges
• Perform a denial of service attack

References

• 1342183 – Security information: Transaction FIAAHELP

Affected components

• BBPCRM (500 to 701)