Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Code injection vulnerability in CRM-MKT-MPL-TPM-PPG, SAP security note 1872638

SAP Note 1872638
SAP Security Note
Medium priority

SAP security note 1872638, “Code injection vulnerability in CRM-MKT-MPL-TPM-PPG”, is a note released on September 26, 2014. Below are the symptom and SAP recommended solution.

ComponentCRM-MKT-MPL-TPM-PPG (Customer Relationship Management > Marketing > Marketing Planner > Trade Promotion Management > Promotion Guidelines)
PriorityCorrection with medium priority
TypeSAP Security Note
StatusReleased for Customer
Released onSeptember 26, 2014

Description

Symptom

CRM-MKT-MPL-TPM-PPG contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can control the system’s behavior or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

Correction instructions are attached to this SAP Note.

Reason and prerequisites

The program code allows the definition and execution of user-defined code that changes the system’s behavior. A valid and authenticated user is required. Depending on the code, the user can:

  • Inject and run their own code
  • Obtain additional unauthorized information
  • Modify or delete data
  • Alter system output
  • Create new users with higher privileges
  • Perform a denial of service attack

References

Full note on SAP: SAP Support Launchpad note 1872638

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Customer Relationship Management #Marketing Planner #Trade Promotion Management #Promotion Guidelines

Explore More