Due to a vulnerability which exists in the SRM Supplier Self-Services (SRM SUS) application, Vendor Evaluation (SRM VE) application and Registration of Supplier (SRM ROS) application which are part of the SAP Supplier Relationship management (SAP SRM) solution, it is possible for a hacker to inject malicious code into the above mentioned applications at runtime which can allow them to steal the current logged on user’s data and perform unauthorized actions without the knowledge of the logged in user.

Vulnerability Details:

• The hacker can enter a executable HTML or JAVAScript command into the input fields and save it to the database. Once page which display this data is visited by a user for a legitimate business purpose, the JAVAScript command contained in the database will be executed thereby allowing the hacker to receive the data in the current context or modify the data in the current context or execute critical actions without the knowledge of the legitimate logged in user.

Affected Releases:

• SAP SRM 4.0

• SAP SRM 5.0

• SAP SRM 6.0

• SAP SRM 7.0