Potentl modification or disclosure of persist. data in FS-BA, SAP security note 1553872

SAP security note 1553872, "Potential Modification or Disclosure of Persistent Data in FS-BA". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit FS-BA-PM-AFP and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

Please install this correction via support package or Note Assistant.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify the data.

References

Affected components

• FSAPPL: 200
• FSAPPL: 300
• BANK-ALYZE: 42
• BANK-ALYZE: 50