SQL injection in Solution Documentation Assistant, SAP security note 1415665

SAP security note 1415665, "SQL injection in Solution Documentation Assistant", is a note released on 10.02.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

A user might tamper with a search result list using specially crafted inputs for certain search criteria in the Solution Documentation Assistant.

Solution

Replace the dynamic WHERE clause with a fixed WHERE clause. Import the relevant Solution Manager Support Package or use the SAP Note Assistant to implement this SAP Security Note.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs a WHERE clause that includes strings manipulable by a malicious user. This manipulated SQL statement can be used to retrieve additional information from the database.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)