Potential disclosure of persisted data in Bank Analyzer, SAP security note 1567747

SAP security note 1567747, "Potential disclosure of persisted data in Bank Analyzer", is a program error note released on 10.05.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit Bank Analyzer by using specially crafted inputs to modify database commands. This manipulation can result in the retrieval of additional information stored by the system.

Solution

Implement the attached correction instructions provided in the SAP Security Note or apply the corresponding support packages.

Reason and prerequisites

The issue stems from an SQL injection vulnerability in the code that constructs SQL statements. These statements include strings that can be altered by malicious inputs, allowing unauthorized data retrieval from the database.

References

• Avoiding SQL Injections
• Downporting the class CL_ABAP_DYN_PRG
• Automatic checks for security notes using RSECNOTE (outdated)