Code injection vulnerability in ECC PT PSM-FM Add-On, SAP security note 1452661

SAP security note 1452661, "Code injection vulnerability in ECC PT PSM-FM Add-On". Below are the symptom and SAP recommended solution.

Description

Symptom

ECC 5.00, ECC 6.00 – 6.04 PT PSM-FM Add-On (Public Sector Funds Management for Portugal) contains code which allows executing arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without legitimate credentials.

Solution

Apply the attached correction instructions or implement the support packages in which the corrections have been included.

Reason and prerequisites

The program code contains a possibility to define and execute code of the user’s choice, which changes the system’s behavior. A valid and authenticated user with authorization for transaction SA38 or SE38 is required.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)