DS tool Potential change or disclosure of persisted data, SAP security note 1577946

SAP security note 1577946, “DS tool: Potential change or disclosure of persisted data”, is a program error note released on 13.09.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit methods of the digital signature tool and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

Import the Support Package that is relevant for this note.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify the data.