SAP security note 1463392, "Potential disclosure, modification of persisted data in BRF+.". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the BRFplus application by using specially crafted inputs to execute arbitrary database commands. This can lead to the retrieval, modification, or removal of data persisted by the system.
Solution
A check has been implemented to ensure the validity of the trace table. To address the vulnerability, please implement the automatic corrections provided with the SAP Note.
Reason and prerequisites
The issue is caused by an SQL injection vulnerability. The application composes SQL statements that include strings susceptible to manipulation by malicious users. This allows the altered SQL statements to retrieve or modify additional information from the database.
References
Affected components
- SAP_BASIS
Full note on SAP: SAP Support Launchpad note 1463392
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
