Potential disclosure of persisted data in SAP CPQ Solution Configuration, SAP security note 2153625

SAP security note 2153625, “Potential disclosure of persisted data in SAP CPQ Solution Configuration”, is a program error note released on 15.04.2015. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can exploit SAP CPQ Solution Configuration and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Please implement the correction instructions attached to this note.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings which can be altered by an attacker. The manipulated SQL statement can then be used to retrieve data from the database.

References

• 1672685 – Solution to incompatible behaviour of FM EXTRACT_DATA
• 2150625 – Potential disclosure of persisted data in SAP CPQ Solution Sales Configuration

Affected components

• SLCC 701
• SLCE 605