Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Easy Task Planning Tightened check, SAP security note 1504803

SAP Note 1504803SAP Security NoteHigh priority

SAP security note 1504803, "Easy Task Planning: Tightened check", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentEnterprise Portal > SAP Enterprise Portal Content > Manager functionality > BP for Manager Self-Service (FI)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released onDecember 14, 2010
LanguageEnglish

Description

Symptom

By making specific entries, an attacker can force the function modules ETP_STANDALONE_DEL_ADDFIELDS and ETP_STANDALONE_SAVE_ADDFIELDS to divulge additional data.

Solution

A tightened check for a generic table access is inserted.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code contains an SQL statement composed of strings that can be altered by a malicious user.

Affected components

  • SAP_APPL 600
  • SAP_APPL 602
  • SAP_APPL 603
  • SAP_APPL 604
  • SAP_APPL 605

Full note on SAP: SAP Support Launchpad note 1504803

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SQL injection#Easy Task Planning#ETP_STANDALONE_GET_ADDFIELDS

Explore More