SAP Security Note
High priority
SAP security note 1491236, “Unauthorized modification of displayed content SLCM BSP Appl”, is a program error note released on 12.10.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
The BSP Applications in Student Lifecycle Management could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
Please apply the SAP Security Note 1491236 for correction.
Reason and prerequisites
Session.htm, Session_Advisor.htm, and Session_student.htm pages within the Applications PIQ_AUDIT, PIQ_DEMOTT, PIQ_DEMOMODBOOK do not sufficiently encode INPUT parameters, resulting in a reflected cross-site scripting (XSS) issue. This vulnerability can be exploited to non-permanently deface or modify displayed content and steal user authentication information.
References
Full note on SAP: SAP Support Launchpad note 1491236
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
