Potential disclosure of persisted data in IS-H-PM, SAP security note 1609146

SAP security note 1609146, “Potential disclosure of persisted data in IS-H-PM”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can exploit IS-H-PM by using specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

An advance correction is available. Follow the correction instructions below to mitigate the vulnerability.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The affected code composes an SQL statement that includes strings which can be altered by an attacker. This manipulated SQL statement can then be used to retrieve data from the database.

Affected components

• Industry-Specific Components > Hospital > Patient Management (IS-H-PM)
• Industry-Specific Components > Hospital > Patient Accounting (IS-H-PA)