Potential disclosure of persisted data in Payment Advice Mgt, SAP security note 1589504

SAP security note 1589504, "Potential disclosure of persisted data in Payment Advice Mgt", is a program error note released on 30.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit /FSPAM/_CP_PERSISTENCE_OBJECT and use specially crafted inputs to modify data-base commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement this Note via SNOTE or import the relevant support package.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.