SAP security note 1609900, “Potential disclosure of persisted data in the Q&Adb”, is a note released on November 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the Question and Answer database (Q&Adb) and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.
Solution
By importing the specified Support Packages or using transaction SNOTE to implement the correction instructions, the affected program sections are deleted or no longer run. Since the ASAP Question and Answer database is obsolete and is no longer used in any products, the affected program sections are no longer required.
Reason and prerequisites
This problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.
CVSS
Score 0
Affected components
- SAP_BASIS 46A to 46D
- SAP_BASIS 610 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 731
- SAP_BASIS 800 to 802
Full note on SAP: SAP Support Launchpad note 1609900
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
