SAP security note 1497346, “Unnecessary database SELECT”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.
Description
#### Symptom A malicious user can exploit and use specially crafted inputs, resulting in the retrieval of information.
#### Other Terms SQL injection, database
#### Reason and Prerequisites The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.
#### Solution Import the relevant Support Package or implement the correction instructions. Manual steps are not necessary.
Full note on SAP: SAP Support Launchpad note 1497346
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
