Potential disclosure of persisted data in BPE, SAP security note 1587445

SAP security note 1587445, "Potential disclosure of persisted data in BPE", is a program error note released on 12.07.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit BPE and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement the referenced Support Package for your release or the correction instructions attached to this note. In the latter case, non-essential parts of the correction are only provided through a Support Package.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.