SAP security note 1591197, “Potential modification/disclosure of data.”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the AFX generator and AFX Archiving engine applications by using specially crafted inputs to execute arbitrary commands. This can lead to the retrieval, modification, or removal of data persisted by the system.
Solution
A check has been implemented to ensure the validity of the trace table. To fully address the issue, please implement both the automatic and manual corrections attached to the note.
Reason and prerequisites
The vulnerability arises from an injection flaw where the code constructs statements using strings that can be manipulated by a malicious user. This manipulation allows the attacker to retrieve additional information or potentially modify data.
Affected components
- SAP_ABA (700 to 702, 710 to 730)
Full note on SAP: SAP Support Launchpad note 1591197
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].