SAP security note 1428526, "Hardcoded usernames in APO", is a program error note released on September 7, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
Username is hard coded in a portion of a code which is no longer relevant. The code containing the hard coded username has been added for internal testing and does not affect the business process. It cannot harm any component. Hence, implementing this note cannot cause any kind of damage.
Solution
Please implement the note and make the necessary corrections accordingly.
Reason and prerequisites
Hard-coded user names (Backdoor)
The program code contains a hard-coded username which changes the system’s behavior should a user authenticate successfully. The username was hard coded in the include file /SAPAPO/LRET_SURFACE_RPF77, which is not compliant with security standards.
References
Full note on SAP: SAP Support Launchpad note 1428526
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].