Potential modif. or disclosure of persisted data in WFM, SAP security note 1638596

SAP security note 1638596, “Potential modif. or disclosure of persisted data in WFM”. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can exploit WFM (Workforce Management) by using specially crafted inputs to modify database commands. This can result in either the retrieval of additional information or the modification of data persisted by the system.

Affected function modules:

• WFACS_CALCSTATUSES_GET
• WFATM_CLEAN_TEMP_TABLES
• WFA_DATE_DEP_ADD
• WFA_DATE_DEP_ADD_HISTORY
• WFA_DATE_DEP_PARENT_ADD
• WFA_TEXT_MODIFY

Solution

Apply the provided corrections to prevent short dumps by encoding the input values used within the SQL statements. This issue can occur when the mentioned function modules are called within an RFC-enabled call stack.

Reason and prerequisites

The vulnerability is caused by an SQL injection flaw. The code constructs an SQL statement that includes strings controllable by an attacker. This manipulated SQL statement can be used to retrieve additional data from the database or modify existing data.

References

• WFM 3.0 SP15 Collective Note (KBA 1736562)