Potential modification of persisted data in Business Config., SAP security note 1538382

SAP security note 1538382, "Potential modification of persisted data in Business Config.". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit Business Configuration and use specially crafted inputs to modify database commands, resulting in the modification of data persisted by the system.

Solution

Please apply the support package mentioned in this note or the respective correction instruction.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to modify information in the database.