SAP security note 1592430, "Potential disclosure of persisted data in FI-CAX", is a program error note released on 16.08.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit FI-CAX (Extended FI-CA) and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.
Solution
Implement the correction instructions relevant for your release, or import the relevant Support Package.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.
This note is relevant only if you use the application component FI-CAX (software component for extended FI-CA). If you do not use these components, you are not affected by the problem and do not have to implement this note.
CVSS
Score 0
References
This note refers to
Referenced by
Affected components
- FI-CAX 471
- FI-CAX 472
- FI-CAX 600
- FI-CAX 602
- FI-CAX 603
- FI-CAX 604
- FI-CAX 605
Full note on SAP: SAP Support Launchpad note 1592430
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].