Possible disclosure of persistent data in a system, SAP security note 1492070

SAP security note 1492070, “Possible disclosure of persistent data in a system”, is a program error note released on 14.02.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit an RFC connection to a remote system and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Import the relevant Support Package or implement the manual correction instructions.

Reason and prerequisites

This problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.

Affected components

• ST-PI 2008_1_46C and above
• ST-PI 2008_1_620 and above
• ST-PI 2008_1_640 and above
• ST-PI 2008_1_700 and above
• ST-PI 2008_1_710 and above