SAP security note 1482449, "Potential disclosure and modification of persisted data", is a program error note released on December 14, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can exploit the IPM Mass Change database batch data loading reports by using specially crafted inputs. This exploitation can lead to the execution of arbitrary SQL commands, enabling the retrieval, modification, or deletion of data persisted by the system.
Solution
To mitigate this vulnerability, assign the affected reports to an authorization group (MC_ADMIN) and implement the provided correction instructions. This limits access to authorized administrators only, thereby preventing unauthorized exploitation.
Reason and prerequisites
The vulnerability is caused by an SQL injection flaw. The application composes SQL statements that include user-controllable strings without proper sanitization, allowing attackers to manipulate the SQL queries.
Full note on SAP: SAP Support Launchpad note 1482449
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
