Potential disclosure of persisted data in SCM-BAS-SCH, SAP security note 1505967

SAP security note 1505967, “Potential disclosure of persisted data in SCM-BAS-SCH”, is a note released on December 14, 2010. Below are the symptom, reason and prerequisites, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit the SCM-BAS-SCH component by using specially crafted inputs to modify database commands. This manipulation can lead to the retrieval of additional information persisted by the system, posing a significant security risk.

Solution

Implement the attached source code corrections provided in SAP Note 1505967 to mitigate the SQL injection vulnerability.

Reason and prerequisites

The vulnerability arises from an SQL injection flaw where the code constructs SQL statements by incorporating user-controllable strings without proper sanitization. This allows attackers to alter the intended SQL commands to access unauthorized data.

Affected components

• SCM (400, 410)
• SCM_BASIS (500, 510, 700, 701)