High priority
SAP security note 1484930, "Saved data may be disclosed and changed", was released on August 10, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can use the class CL_IUPROFIL_SERVICE to change, display, or delete any data by making specific entries.
Solution
Implement the attached corrections provided in the SAP Security Note.
Reason and prerequisites
This vulnerability arises from a SQL injection flaw. In the source code, SQL statements are composed of strings without proper validation. An attacker can control the contents of a substring, manipulate the entire SQL statement, and execute arbitrary SQL commands with the privileges of the logged-in database user.
References
Affected components
- BBPCRM 600
- BBPCRM 700
- BBPCRM 701
Full note on SAP: SAP Support Launchpad note 1484930
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].