Medium priority
SAP security note 2051717, “SQL injection vulnerability in SAP NetWeaver”, was released on September 15, 2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A SQL injection vulnerability has been identified in SAP NetWeaver, allowing malicious users to execute targeted database queries. This can potentially expose the back-end database, leading to severe security impacts.
The SQL injection vulnerability can result in:
- Data Exposure: Unauthorized reading of sensitive data.
- Data Modification: Alteration or deletion of data within the database.
- Administrative Operations: Execution of operations at the admin level on the database.
Solution
To mitigate this vulnerability, implement the correction instructions or import the relevant Support Package. This will enforce proper checks on input parameters, eliminating the risk of SQL injection.
- SAP_BASIS 700: Implement SAPKB70032.
- SAP_BASIS 701: Implement SAPKB70117.
- SAP_BASIS 702: Implement SAPKB70217.
- SAP_BASIS 710: Implement SAPKB71019.
- SAP_BASIS 711: Implement SAPKB71114.
- SAP_BASIS 730: Implement SAPKB73013.
- SAP_BASIS 731: Implement SAPKB73114.
- SAP_BASIS 740: Implement SAPKB74009.
Affected components
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 711
- SAP_BASIS 730
- SAP_BASIS 731
- SAP_BASIS 740
Full note on SAP: SAP Support Launchpad note 2051717
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].