SAP security note 1497656, "Hard-coded Username/Password in [BC-CUS,BC-CUS-TOL-IMG]", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Hard-coded usernames [BC-CUS] contains code which changes the program’s behavior when a user successfully authenticates with a certain username.
Solution
Apply this note.
Reason and prerequisites
The program code contains a hard-coded username that changes the system’s behavior when a user authenticates successfully. The user may obtain additional information that should not be displayed. The vulnerability is caused by a hard-coded username-password combination in the program’s source code.
Affected components
- SAP_BASIS 46C to 46C
- SAP_BASIS 620 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
Full note on SAP: SAP Support Launchpad note 1497656
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
