SAP security note 1497854, "Code Injection Vulnerability in [BC-SRV-ARL]", is a program error note released on December 14, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
The [BC-SRV-ARL] component contains code that allows the execution of arbitrary program code chosen by the user. A malicious user can control the system’s behavior or escalate privileges by executing malicious code without needing legitimate credentials.
Solution
Implement the necessary code corrections via SNOTE. Alternatively, you can upgrade to the relevant Support Package (SP) to address this vulnerability.
Reason and prerequisites
The vulnerability arises because the program code allows users to define and execute their own code, thereby changing the system’s behavior. This requires a valid and authenticated user. Depending on the injected code, the user can:
- Inject and run their own code
- Obtain additional unauthorized information
- Modify or delete data
- Alter the system’s output
- Create new users with higher privileges
- Perform a denial of service attack
CVSS
Score 0
Full note on SAP: SAP Support Launchpad note 1497854
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].