Potential disclosure of persisted data in WEC-APP-CI-REV, SAP security note 1592076

SAP security note 1592076, “Potential disclosure of persisted data in WEC-APP-CI-REV”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit a vulnerability in WEC-APP-CI-REV and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Please apply the following correction instructions.

Reason and prerequisites

The problem is caused by a SQL injection vulnerability. The code includes a SQL statement that contains strings a malicious user can alter. The manipulated SQL statement can then be used to retrieve unauthorized data from the database.