SAP Security Note
Medium priority
SAP security note 1496547, "BAPI_ADMGMTSO_CREATEFROMDATA: Foreign key check is missing", is a program error note released on 28.01.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
This security note was updated. For details, refer to security note 1553287.
BAPI_ADMGMTSO_CREATEFROMDATA can be used to create orders with an invalid order origin or an invalid purchase order date, for example.
Solution
This note ensures that a foreign key check or a value check is executed for all fields of the BAPI input parameters if a consistency check was not previously executed. Additionally, the date fields are validated to determine whether the date value is valid.
Reason and prerequisites
Security standard SEC-132 stipulates that all input fields or parameters must be validated to ensure data integrity and prevent security vulnerabilities.
References
This note refers to
- SAP Note 1553287 – Update #1 to Security Note 1496547
Full note on SAP: SAP Support Launchpad note 1496547
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].