Potential disclosure of persisted data in FI-CA, SAP security note 1591314

SAP security note 1591314, "Potential Disclosure of Persisted Data in FI-CA", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit Contract Accounts Receivable and Payable (FI-CA) by using specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement the correction instructions relevant for your release or import the relevant Support Package.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code constructs an SQL statement that includes strings which can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.

Affected components

• Industry-Specific Components > Public Sector Solutions > Public Sector Contract Accounting (IS-PS-CA)
• Industry-Specific Components > Media > Contract Accounts Receivable and Payable (IS-M-CA)
• Industry-Specific Components > Industry-Specific Component Telecommunications > Contract Accounting (IS-T-CA)
• Industry-Specific Components > Utilities > Contract Accounts Receivable and Payable (IS-U-CA)
• Financial Services > Collections and Disbursements (FS-CD)
• Financial Accounting > Non-industry specific contract accounts receivable, payable (FI-CAX)