Potential modification or disclosure of persisted data in co, SAP security note 1510796

SAP security note 1510796, "Potential modification or disclosure of persisted data in condition technique", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit condition technique and use specially crafted inputs to modify database commands, resulting in either the retrieval of additional information or modification of data persisted by the system.

Solution

Apply the attached correction instructions.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or modify it.