Potential selection of persisted data in SV-SMG-UAE, SAP security note 1579331

SAP security note 1579331, "Potential selection of persisted data in SV-SMG-UAE". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit SV-SMG-UAE and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system.

Solution

To fix the security issue, implement this SAP note via the SNOTE transaction. These issues are fixed in ST710 SP2 and above releases.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it. These issues are observed in ST710 SP0 release and below.

References

• SAP Note 1584162 – SAP Solution Manager – Basic functions 7.1 SP2
• SAP Note 1552585 – SAP Solution Manager: Basic functions 7.1 SP1