Skip links

Dynamic SQL Statements Giving Rise to Security Concerns, SAP security note 1501635

Description

Some dynamic SQL statements in the BCA module give rise to security concerns. If user input is directly incorporated into dynamic SQL statements, malicious users can inject SQL clauses into these statements in such a way that they can obtain information otherwise inaccessible to them. It is not always easy to determine whether user input can be contained in a dynamic SQL statement. Therefore dynamic SQL statements should be avoided.

Available fix and Supported packages

  • EA-FINSERV | 110 | 110
  • EA-FINSERV | 200 | 200
  • EA-FINSERV | 500 | 500
  • EA-FINSERV | 600 | 600
  • EA-FINSERV | 603 | 603
  • EA-FINSERV | 604 | 604
  • EA-FINSERV | 605 | 605
  • BANK/CFM | 463_20 | 463_20
  • EA-FINSERV 605 | SAPK-60502INEAFINSRV |
  • EA-FINSERV 110 | SAPKGPFA31 |
  • EA-FINSERV 200 | SAPKGPFB20 |
  • EA-FINSERV 500 | SAPKGPFC24 |
  • EA-FINSERV 600 | SAPKGPFD19 |
  • EA-FINSERV 603 | SAPK-60308INEAFINSRV |
  • EA-FINSERV 604 | SAPK-60409INEAFINSRV |
  • BANK/CFM 463_20 | SAPKIPBJ39 |

Affected component

    IS-B-BCA
    Bank Current Accounts

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1501635

TAGS

#SQL
#injection.