Potential disclosure of persisted data in test code, SAP security note 1571325

SAP security note 1571325, "Potential disclosure of persisted data in test code", is a program error note released on 10.05.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit a function module initially designed for testing purposes by using specially crafted inputs to modify database commands. This can result in the retrieval of additional information persisted by the system.

Solution

Apply the corresponding corrections provided in this security note.

Important: On systems with BASIS releases ≤ 6.40, manual steps must be performed in addition to the automatic note implementation.

• Call the function module named in the correction instruction using transaction SE37.
• Go to the Attributes tab and set the processing type to “Normal Function Module”.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

Affected components

• SAP_APPL: From 46B to 605