SAP security note 1475083, "Possible disclosure of saved data in cluster builder". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This note is relevant only if you use the application component FS-CD (software component INSURANCE). If you do not use this component, you are not affected by the problem and you do not have to implement this note.
An attacker can output any data by making specific entries in a function module.
Solution
The relevant parts of the function module interface are not used. This note modifies the source code by turning it into a comment.
Reason and prerequisites
This vulnerability is due to a SQL injection deficiency. In the source code, an SQL statement is composed out of strings. An attacker can gain control over the content of a substring, allowing manipulation of the complete statement and execution of all SQL commands with the permissions of the database user that is logged on.
CVSS
Score 0
Affected components
- INSURANCE: versions 471 to 605
Full note on SAP: SAP Support Launchpad note 1475083
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].