SAP security note 1485492, "Hard-coded user name in article maintenance". Below are the symptom and SAP recommended solution.
Description
Symptom
A hard-coded user name can change the system behavior if a user is authenticated to the system using this name.
Solution
Implement the attached corrections.
Reason and prerequisites
The program source code contains a hard-coded user name. If a user successfully logs on to the system with this name, an undesired additional function that was implemented for test purposes only may be executed. Calling the additional function has no direct effects, as only data that is not then processed further is returned to the calling program. In extreme cases, the additional function only slightly increases the runtime of the application.
Full note on SAP: SAP Support Launchpad note 1485492
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
