SAP Security Note
High priority
SAP security note 1475192, “Code Injection Vulnerability in WEBCUIF Components”, is a note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The CRMOST_SIMPLE_EVENT_RECEIVER contains code that enables the execution of arbitrary program code chosen by the user. A malicious authenticated user can exploit this vulnerability to control system behavior, escalate privileges, execute malicious code without legitimate credentials, access unauthorized information, modify or delete data, alter system outputs, create new users with higher privileges, or perform a denial of service attack.
Solution
To mitigate this vulnerability, it is imperative to implement SAP Note 1475192. Applying this note will address the security flaw and protect your system from potential exploitation.
Affected components
- BBPCRM 510
- BBPCRM 520
- BBPCRM 600
- WEBCUIF 700
- WEBCUIF 701
- WEBCUIF 730
Full note on SAP: SAP Support Launchpad note 1475192
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].