SAP Security Note
High priority
SAP security note 1902854, "Potential modif./disclosure of persisted data in BC-DB-MSS", is a program error note released on 07.10.2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can exploit a function module in BC-DB-MSS to execute SQL injection attacks, leading to unauthorized data retrieval or modification.
Solution
To mitigate this vulnerability, apply Note 1902854 using transaction SNOTE in your SAP system.
Reason and prerequisites
The vulnerability arises from the composition of SQL statements using user-controllable input without proper sanitization, allowing attackers to manipulate the SQL commands.
CVSS
Score 7.0 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:C
Full note on SAP: SAP Support Launchpad note 1902854
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
