SAP security note 1478978, "Potential disclosure of DB data in CL_BBP_PERSIST_EVENT_CONT", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit CL_BBP_PERSIST_EVENT_CONT and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system. The dynamic ‘where’-clause can be manipulated by the attacker to insert malicious code.
Solution
The correction will be delivered in the corresponding Support Packages of the SRM_SERVER. For advanced correction, please implement the attached corrections in coding.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it.
CVSS
Score 0
References
This note refers to
Affected components
- SRM_SERVER 550
- SRM_SERVER 700
- SRM_SERVER 701
Full note on SAP: SAP Support Launchpad note 1478978
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].