Potential modif./disclosure of persisted data in SCM, SAP security note 1798286

SAP security note 1798286, "Potential modification/disclosure of persisted data in SCM", is a program error note released on July 9, 2013. Below are the symptom and SAP recommended solution.

Description

Symptom

Component: EH&S Services in SCM

An attacker can exploit the EH&S services in the Supply Chain Management (SCM) and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

The “Reference to Support Packages” section specifies the Support Packages that contain the corrections.

Alternatively, you can implement the following correction instructions.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify this data.

References