SAP security note 1490083, "Potential modification of persisted data in CRM-CHM-POS". Below are the symptom and the SAP recommended solution.
Description
Symptom
A malicious user can exploit CRM-CHM-POS and use specially crafted inputs to modify database commands, resulting in the modification of data persisted by the system.
Solution
Apply the note.
Reason and prerequisites
Generation of Program CMS_[APPLICATION_NAME]_GEN_MODULE_POOL if an incorrect APPLICATION_NAME (apart from those available in the table CMSC_LO_APPL) is passed.
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to modify information in the database.
Full note on SAP: SAP Support Launchpad note 1490083
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
