SAP Security Note
High priority
SAP security note 1142067, "Missing authorization check for hidden functions", is a program error note released on October 8, 2009. Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
You can use authorization objects to display or hide functions in applications. However, you can still execute these functions by manipulating the URL on a Business Server Page (BSP). An additional authorization check before execution is missing.
Solution
Import the Support Package specified in the attachment or implement the correction instructions.
Reason and prerequisites
This problem is caused by a design error.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1142067
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
