Potential disclosure of persisted data in PFW, SAP security note 1553184

SAP security note 1553184, "Potential disclosure of persisted data in PFW", is a program error note released on March 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit the Processing Framework (PFW) by using specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement the attached correction or apply the corresponding support package.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings which can be manipulated by a malicious user. The altered SQL statement can then be used to retrieve data from the database.

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• FSAPPL 200
• FSAPPL 300
• BANK-ALYZE 42
• BANK-ALYZE 50