Potential disclosure of data in customer/vendor search, SAP security note 1511749

SAP security note 1511749, "Potential disclosure of data in customer/vendor search", is a note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit vendor and customer master records and use specially crafted inputs to modify database commands, resulting in either the retrieval of additional information or modification of data persisted by the system.

Solution

Implement the attached corrections or import the relevant Support Package.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or modify it.

References

• Composite SAP Note: Security for FI-AR/FI-AP

Affected components

• Financial Accounting > Accounts Payable > Basic Functions > Master Data