SAP security note 1580617, "Code Injection Vulnerability in SV-SMG-UAE", is a program error note released on 14.06.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SV-SMG-UAE contains code that permits the execution of arbitrary program code of the user's choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.
Solution
To address the security issue, implement this SAP note via the SNOTE transaction. These issues are fixed in ST710 SP2 and later releases.
Reason and prerequisites
The program code includes a feature that allows the definition and execution of user-defined code, altering the system's behavior. A valid and authenticated user is required.
CVSS
Score 0
References
Affected components
- ST 400
- ST 710
Full note on SAP: SAP Support Launchpad note 1580617
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].