Potential modification or disclosure of persisted data, SAP security note 1559996

SAP security note 1559996, “Potential modification or disclosure of persisted data”, is a program error note released on 12.04.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can exploit SAP Solution Manager 7.1 and use specially crafted inputs to disclose additional data or change data that is saved in the database.

Solution

A corrected version is delivered with SAP Solution Manager 7.1 Support Package 01.

Reason and prerequisites

This problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve additional data from the database, or to modify the data.