Persisted data in MAP may be changed/disclosed, SAP security note 1794273

SAP security note 1794273, "Persisted data in MAP may be changed/disclosed", is a program error note released on 28.10.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can exploit vulnerabilities within merchandise and assortment planning and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information, or the modification of data persisted by the system.

Solution

Implement the attached correction instructions.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve additional data from the database, or to modify the data.

References

• Runtime error when entering the manual planning

Affected components

• SAP_APPL from 46C to 46C
• SAP_APPL from 470 to 470
• SAP_APPL from 500 to 500
• SAP_APPL from 600 to 600
• SAP_APPL from 602 to 602
• SAP_APPL from 603 to 603
• SAP_APPL from 604 to 604
• SAP_APPL from 605 to 605
• SAP_APPL from 606 to 606
• SAP_APPL from 616 to 616
• PI from 2004_1_470 to 2004_1_500