SAP security note 1978131, "Missing authorization check in EP-PCT-PUR-BP", is a program error note released on 13.01.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of EP-PCT-PUR-BP to which access should be restricted. This may result in an escalation of privileges.
Solution
Import the relevant support package or implement this SAP Note using transaction SNOTE.
Reason and prerequisites
EP-PCT-PUR-BP does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1978131
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].