SAP security note 1466609, "Backdoor & Code Injection in Enhancement Code", is a program error note released on 14.09.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Presence of backdoor and code injection capabilities in the Enhancement framework’s SEEF_COPY package.
Solution
Apply the support package mentioned in this note. An individual correction instruction is not available due to the complexity of the code artifacts that need to be removed.
Reason and prerequisites
The vulnerable code in SEEF_COPY cannot be accessed via the enhancement framework’s user interface but can be exploited through other ABAP code. Exploitation can lead to information disclosure, privilege escalation, and application malfunctions.
Affected components
- SAP_BASIS: Versions 711 to 720
Full note on SAP: SAP Support Launchpad note 1466609
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].