SAP security note 1489660, "Potential disclosure of data in Direct Store Delivery", is a note released on October 12, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
In transaction SE37, a malicious user can use a function module from Direct Store Delivery to trigger the disclosure of additional data by using specially crafted inputs.
Solution
- Prevent the unauthorized use of transaction SE37 in your production system.
- Implement this note.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.
Full note on SAP: SAP Support Launchpad note 1489660
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].