Potential disclosure of persisted data in AP MD BP, SAP security note 1835366

SAP security note 1835366, "Potential disclosure of persisted data in AP MD BP", is a program error note released on September 2, 2015. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can exploit AP MD BP and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system. This note is a cause and side effect note for 1748129.

Solution

Implement this note to address the SQL injection vulnerability.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve data from the database.

CVSS

Score 0

Affected components

• SAP_ABA 620
• SAP_ABA 640
• SAP_ABA 700 to 702
• SAP_ABA 710 to 711
• SAP_ABA 730 to 731
• SAP_ABA 740