High priority
SAP security note 1816331, "Code injection vulnerability in BC-SRV-ALV", is a note released on June 11, 2013. Below are the symptom and SAP recommended solution.
Description
Symptom
BC-SRV-ALV contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.
Solution
Implement the changes specified in the correction instructions using transaction SNOTE or by importing the relevant Support Package.
Reason and prerequisites
The program code contains the ability to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is required. Depending on the code, the user can:
- Inject and run their own code
- Obtain additional information that should not be displayed
- Modify or delete data
- Modify the system’s output
- Create new users with higher privileges
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1816331
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].