Potential disclosure of persisted data in WEBCUIF, SAP security note 1470407

SAP security note 1470407, "Potential disclosure of persisted data in WEBCUIF". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit some of the Web UI Framework applications and features by using specially crafted inputs to modify database commands. This can result in the retrieval of additional information persisted by the system. The affected components include:

• SFLIGHT test application
• Business Role Customizing Tool application
• Report CRM_GENIL_CUST_COPY2
• Classes CL_AXT_CHECK_TABLE_HANDLER, CL_CRM_UI_COMPONENT_PROFILE
• Report CRM_THTMLB_UI_SEARCH

Solution

Please apply this note.

Reason and prerequisites

This issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings which can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database.

Affected components

• CRMUIF: Versions 520, 600
• WEBCUIF: Versions 700, 701, 730