SAP security note 1589296, "Potential modification or disclosure of persisted data", is a program error note released on 12.07.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the function module ISU_CRM_IL_REMOTE_CUST_READ and use specially crafted inputs to modify, issue, or delete data.
Solution
Implement the corrections provided in the support packages.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user to gain control of the content of a partial string. The resulting total statement can be manipulated, and therefore, all of the SQL commands can be executed with the rights of the database user who is logged on.
Affected components
- IS-UT
Full note on SAP: SAP Support Launchpad note 1589296
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].