SAP Security Note
High priority
SAP security note 1608651, "Unauthorized modification of stored content in PA-PD-PM", is a note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
PA-PD-PM can be abused by an attacker, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.
Solution
Import the appropriate Support Package for your release or implement the attached correction instructions to resolve the issue.
Reason and prerequisites
- Issue: Stored cross-site scripting (XSS) in the BSP applications HAP_DOCUMENT and HAP_Q_PROFILE.
- Impact: Allows unauthorized modification of displayed web content and theft of user authentication information, potentially leading to full compromise of the application if an administrator is impersonated.
References
This note refers to
Affected components
- SAP_ABA 640 to 731
- EA-HRGXX 110 and 200
Full note on SAP: SAP Support Launchpad note 1608651
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].