Potential disclosure of persisted data in the monitors, SAP security note 1594644

SAP security note 1594644, “Potential disclosure of persisted data in the monitors”, is released on 02.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit the monitors and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement the attached correction instruction.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.

• For releases EA_APPL 500 and upper, note 1487337 or the corresponding support package is implemented before this note.
• For releases EA_APPL 200 and 110, note 1502272 or the corresponding support package is implemented before this note.