SAP security note 1491101, "Potential disclosure of persisted data in AP-BP-BP", is a program error note released on December 14, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can exploit the AP-BP-BP component by using specially crafted inputs to modify database commands. This can result in the retrieval of additional information persisted by the system.
Solution
All vulnerable code segments have been disabled by uncommenting them. Users are advised to follow the correction instructions provided in the SAP Security Note to apply the necessary fixes.
Reason and prerequisites
The issue arises from an SQL injection vulnerability. The affected code constructs an SQL statement that includes strings which can be manipulated by a malicious user. By altering these strings, the attacker can manipulate the SQL statement to retrieve unauthorized data from the database.
References
Full note on SAP: SAP Support Launchpad note 1491101
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
