Potential disclosure of persisted data in SAF, SAP security note 1608317

SAP security note 1608317, "Potential disclosure of persisted data in SAF", was released on November 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can exploit the Software Agent Framework (SAF) using specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement this note or apply the related support package.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings that can be altered by an attacker. The manipulated SQL statement can be used to retrieve data from the database.

Affected components

• SAP_ABA 700
• CRMUIF 510, 520, 600
• WEBCUIF 700, 701, 730, 731, 746