SAP security note 2450979, “SQL Injection vulnerability in SAP CRM WebClient User Interface”. Below are the symptom and SAP recommended solution.
Description
Symptom
Program CRM_THTMLB_UI_SEARCH allows an attacker to execute crafted database queries, exposing the backend database.
Some well-known impacts of SQL Injection vulnerability are:
- Read sensitive data, modify or delete data from the database
- Execute admin-level operations on the database
Solution
User-input search strings are now secured prior to being used for SQL queries.
Please implement the attached Correction Instructions or the mentioned Support Package.
Reason and prerequisites
Reason: User inputs were not encoded against SQL Injections.
CVSS
Score 6.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Full note on SAP: SAP Support Launchpad note 2450979
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].