Medium priority
SAP security note 1833327, "Potential disclosure of persisted data in BC-SRV-ADR", is a note released on January 29, 2014. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can exploit address master data and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.
Solution
Implement the code corrections provided in SAP Note 1833327 to mitigate the SQL injection risk.
Reason and prerequisites
The issue stems from an SQL injection vulnerability where the code constructs SQL statements using strings that can be manipulated by an attacker. This manipulation enables the retrieval of unauthorized data from the database.
Affected components
- BC-SRV-ADR (Address Management / Business Address Services)
- SAP_BASIS: 46C, 620, 640, 700, 702, 710, 730, 731, 740
Full note on SAP: SAP Support Launchpad note 1833327
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
