Trace Possible divulging of saved trace data, SAP security note 1496008

SAP security note 1496008, "Trace: Possible divulging of saved trace data", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit a program or transaction and use specially crafted inputs to execute arbitrary database commands to ensure it outputs trace data.

Solution

Import the Support Package or implement the correction instructions.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. As a result, the attacker can manipulate the entire resulting statement and, therefore, execute all SQL statements with the rights of the database user who is logged on.

CVSS

Score 0