SAP security note 1511877, “Directory traversal/SQL injection in SPM1.0”, is a note released on 14.12.2010. Below is the security information published by SAP for this note.
Description
Symptom
1. SPM1.0 content contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior. 2. A malicious user can exploit SPM1.0 code and use specially crafted inputs to modify database commands, resulting in the modification of data persisted by the system.
Reason and prerequisites
SPM1.0 code contains code which fails to correctly validate the path a user-submitted file is written to. Through this, an attacker can potentially overwrite data on the remote system.
The second issue is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to modify information in the database.
Solution
This code is obsolete for SPM2.0 onwards. Please apply the attached correction instruction to comment out the obsolete code.
Download Links:
- Download for SNOTE
- PDF Version
Credits: https://redrays.io for support to provided information.
Full note on SAP: SAP Support Launchpad note 1511877
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].