High priority
SAP security note 1509222, "Potential disclosure of persisted data: CRM_SVY_DB_SFA_READ", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A SQL injection vulnerability exists in the CRM_SVY_DB_SFA_READ function module. A malicious user can exploit this vulnerability by providing specially crafted inputs to modify database commands, allowing the retrieval of additional information from the system.
Solution
Apply the attached correction instructions to mitigate the SQL injection vulnerability.
CVSS
Score 0
References
- SAP Note 1480248 – Missing Authorization Checks in Survey
Affected components
- BBPCRM 400, 500, 520, 600, 700, 701
Full note on SAP: SAP Support Launchpad note 1509222
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].