SAP Security Note
High priority
SAP security note 1592742, "Potential modification or disclosure of persisted data", is a program error note released on 10.01.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can exploit CRM Internet Sales and CRM Internet Service web applications by using specially crafted inputs to modify database commands. This can result in the retrieval of additional information or the modification of data persisted by the system.
Solution
This note contains Java correction(s) for E-Commerce and Web Channel.
- Apply the Support Package patch level attached to this note.
- For more information about applying Java patches, refer to Note 877887.
- See Note 1546959 for information about the patch strategy.
Reason and prerequisites
The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement containing strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or modify the data.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1592742
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
