Potential modification or disclosure of persisted data, SAP security note 1592784

SAP security note 1592784, "Potential modification or disclosure of persisted data", is a program error note released on 10.01.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit CRM Internet Sales or CRM Internet Service Web applications and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

This note contains Java correction(s) for E-Commerce and Web Channel.

• Apply the Support Package patch level attached to this note.
• For more information about applying Java patches, refer to Note 877887.
• See Note 1546959 for information about the patch strategy.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database, or to modify the data.

CVSS

Score 0

References

Affected components

• SAP-CRMISA: 4.0_640 to 4.0_640
• SAP-CRMJAV: 5.0, 6.0, 700, 701, 730
• SAP-CRMWEB: 5.0, 6.0, 700, 701, 730
• SAP-SHRWEB: 5.0, 6.0, 700, 701, 730
• SAP-SHRJAV: 5.0, 6.0, 700, 701, 730
• SAP-CRMAPP: 5.0, 6.0, 700, 701, 730
• SAP-SHRAPP: 5.0, 6.0, 700, 701, 730