SAP Security Note
Medium priority
SAP security note 1777867, “Potential SQL Injection in FI-CA”, is a program error note released on August 27, 2015. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit FI-CA to perform SQL injection, allowing unauthorized access to sensitive data within the database.
Solution
Implement the relevant correction instructions for your release, or import the applicable Support Package to address the SQL injection vulnerability.
Reason and prerequisites
The vulnerability is caused by an SQL injection flaw where the code constructs SQL statements with strings that can be manipulated by attackers. This manipulation allows the execution of unauthorized database commands to access or modify data.
References
Affected components
- FI-CA 600
- FI-CA 602
- FI-CA 603
- FI-CA 604
- FI-CA 605
- FI-CA 606
- FI-CA 616
Full note on SAP: SAP Support Launchpad note 1777867
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].