SQL Injection in SAF-T Portugal, SAP security note 2319577

SAP security note 2319577, “SQL Injection Vulnerability in SAF-T Portugal”, is released on 27.10.2020. Below are the symptom and SAP recommended solution.

Description

Symptom

The vulnerability exists in the SAF-T Portugal feature of the FI-CA component, enabling an attacker to execute malicious SQL queries. This can lead to:

• Unauthorized access to sensitive data
• Modification or deletion of data within the database
• Execution of administrative-level operations on the database

Exploiting this SQL Injection vulnerability can result in significant data breaches, data integrity issues, and unauthorized administrative actions, compromising the security and reliability of the SAP system.

Solution

To mitigate this vulnerability, SAP has released this security note which includes the following actions:

• Input Validation: The program now rigorously screens user inputs to ensure data is submitted correctly and removes any dangerous SQL statements.
• Implementation: It is crucial to implement this SAP Note to secure your SAP systems against potential SQL Injection attacks.

CVSS

Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N