HR-RUPotential modification or disclosure of persisted data, SAP security note 1621073

SAP security note 1621073, "HR-RU: Potential modification or disclosure of persisted data", is a program error note released on November 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit HR-RU reports by using specially crafted inputs to modify database commands, leading to the retrieval of additional information or the modification of persisted data. This vulnerability is caused by an SQL injection flaw where user-controlled input is improperly handled in SQL statements.

• Data Exposure: unauthorized retrieval of sensitive information from the database.
• Data Manipulation: unauthorized modification of persisted data within the system.

Solution

Implement the corrections as described in the Correction Instructions or import the relevant HR Support Package for your system.

Reason and prerequisites

The vulnerability arises from an SQL injection issue in the HR-RU reports. The application constructs SQL statements using strings that can be manipulated by a malicious user, allowing them to alter the intended SQL commands.

References

• SAP Note 888889: Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_HRCRU versions 600 and 604