SAP Security Note
High priority
SAP security note 1542784, "Hard-coded credentials in EA-GLTRADE", is a program error note released on 09.08.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can be authenticated to EA-GLTRADE without having their own legitimate credentials, or they may escalate privileges.
Solution
To solve the error, implement the changes contained in the attached correction instructions in your system.
Reason and prerequisites
The vulnerability is caused by a hard-coded username-password combination in the program’s source code. A malicious user who specifies these credentials can log on to the system without having been assigned legitimate access by the system administrator(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.
Full note on SAP: SAP Support Launchpad note 1542784
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].