SAP security note 1867167, "Potential Modification/Disclosure of Persisted Data in CRM-IC-EMS-CAT", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can exploit CRM-IC-EMS-CAT using specially crafted inputs to modify database commands. This results in the retrieval of additional information or the modification of data persisted by the system.
Solution
Implement the correction instructions provided in the SAP Security Note. These instructions contain the necessary corrections to mitigate the SQL injection vulnerability.
Reason and prerequisites
The issue stems from an SQL injection vulnerability caused by the composition of SQL statements that include unvalidated strings. These strings can be altered by an attacker, allowing them to manipulate the SQL statement to their advantage.
References
Affected components
- CRM-IC-EMS-CAT
- BBPCRM versions 500, 600, 700, 701, 702, 712, 713
Full note on SAP: SAP Support Launchpad note 1867167
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].