SAP security note 1387574, "Possible SQL injection in Persistence Service", is released on 22.06.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
This note provides information about a possible SQL injection in the Persistence Service of the Object Services.
Solution
To address these issues, the runtime environment of the Object Services must correctly handle the input values. The error is fixed in the specified Support Package. Alternatively, you can implement the changes in advance by following the provided correction instructions.
Reason and prerequisites
Using the Persistence Service and Query Service of the Object Services to load persistent objects into the roll area can lead to the following issues if a parameter table (parameter I_PARAMETER_TAB of the method GET_PERSISTENT_BY_QUERY of the class actor) is used to transfer the actual values for the search condition: SQL Injection; Runtime Errors: SAPSQL_LIKE_QUOTES or SAPSQL_WHERE_QUOTES.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1387574
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].